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Section I 
GENERAL 


Paragraph 

Introductory remarks concerning transposition ciphers .. . . . .. ..1 

Basic mechanism of transposition ciphers - , . . ... 2 

Monophase and polyphase transposition-- . - . 3 


1 Introductory remarks concerning transposition ciphers —a As stated m a previous text, 
transposition ciphers are roughly analogous to “jigsaw puzzles” in that all the pieces of which 
the origmal is composed are present but are merely disarranged The pieces mto which the 
picture formmg the basis of a jigsaw puzzle may be divided are usually qmte irregular in size 
and shape, the greater the amount of irr^ulanty, as a rule, the greater the difficulty in reas- 
semblmg the pieces m proper order In this respect, too, transposition ciphers are analogous to 
Jigsaw puzzles, for the greater the amount of distortion to which the plain text is subjected m 
the transposition process, the more difficult becomes the solution 

b In Jigsaw puzzles there is usually no regularity about the size of the mdmdual pieces 
mto which the ongmal picture has been cut, and this feature, of course, materially contiibutes 
to the difficulty m reconstructing the picture There are, to be sure, limits (dictated by con¬ 
siderations of practicabdity) which serve to prevent the pieces being made too small, for then 
they would become unmanageable, on the other hand, there are also limits which must be ob¬ 
served m respect to the upper magnitude of the pieces, for if they are made too large the puzzle 
becomes too easy to solve These features of jigsaw puzzles also have their analogies in trans¬ 
position methods In the latter, if the textual units to be subjected to transposition are made 
qmte large, say entire sentences, the difficulties a cryptanalyst will have m reconstructing the 
text are practically ml, on the other hand, if these textual units aie made quite small, even 
smaller than smgle letters,^ then the reoonstraction of the transposition text by a cryptanalyst 
often becomes a very difficult matter In between these two extremes there may be various 
degrees of fragmentation, limited only by considerations of practicability 

c It IS fortunate, however, that the cryptanalyst does not, as a rule, have to contend with 
problems m which the size of the textual units vanes withm the same message, as is the case m 
Jigsaw puzzles It is perhaps possible to devise a transposition system m which the text is 
divided up m such a manner that entire sentences, whole words, syllables, mdmdual letters, and 
fractions of letters form the units for transposition, but it is not difficult to imagine how imprac¬ 
tical such a scheme would be for regular commumcation, and it may be taken for granted that 
such irregularity in size of textual umts will not be encountered m practical communication 
d The days when the simple methods of word transposition were sufficient for military 
purposes have long since passed by, and it is hardly to be expected that cryptograms of such 
meffectual nature will be encountered m the mihtary co mmuni cations of even the smaller armies 
of today However, m time of emergency, when a counter-espionage censorship is exercised over 
mtemal commumcations, it is possible that isolated instances of simple word transposition may 
be encountered The solution of such cases should present no difficulties, unless numerous code 
names and nulls are also used m the cryptograms Mere experimentation wnth the cryptograms, 
trying various types and sizes of rectangles, will usually disclose the secret text If code names 


■ Reference is here made to so-called fractionating systems 
Cryptography, sec XI 
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are used and the context gives no clue to the identity of the persons or places mentioned, it may 
be necessary to wait until additional messages become available, or, lacking such a possibihty, 
there is usually sufficient justification, under the exigencies of war, to compel the correspondents 
to reveal the meamng of these code names 

e Although transposition ciphers, as a general rule, are much less complex m their mechamcs 
than are substitution ciphers, the cryptanalyst usually expenences a feelmg of distaste and 
dismay when confronted with unknown ciphers of this category There are several reasons for 
his dislike for them In the first place, although transposition ciphers are admittedly less mtncate 
than substitution ciphers, as a general rule there are not nearly so many cryptanalytic tools and 
“tncks” to be used in the solution of the former as there are m the latter, and therefore the 
mental stimulus and satisfaction which the ciyptanalyst usually derives and regards as part of the 
reward for his hard labor m solvmg a cipher is often missmg m the case of transposition ciphers 
In the second place, despite their lack of complexity, the solution of transposition ciphers often 
mvolves a tremendous amoimt of time and labor most of which commonly turns out to be 
frmtless experimentation Thirdly, m modem mihtary commimication, transposition methods 
are usually not employed alone but m conjunction with substitution methods—and then the 
problems may become difficult mdeed, for usually before the substitution can be attacked it is 
necessary first to uncover the transposition Fmally, m workmg with transposition ciphers a 
much higher degree of accuracy m mere mechamcal operations is required than m workmg with 
substitution ciphers, because the accidental omission or addition of a smgle letter wdl usually 
necessitate rewntmg the work sheets applymg to entire messages and startmg afresh Thus, 
this sort of work calls for a constant state of concentrated attention, with its resulting state of 
psychological tension, which takes its toll m mental wear and tear 

2 Basic mechamsm of transposition ciphers —a Basically, all transposition ciphers mvolve 
at least two processes (1) Wntmg the plam-text umts (usually smgle letters) withm a specific 
regular or irregular two-dimensional design called a “matrix,” “cage,” “frame,” “rectangle,” 
etc , m such a prearranged manner that the said umts are distributed regularly or irregularly 
throughout the vanous cells or subsections of that design, (2) removing the plain-text umts 
from the design m such a prearranged manner as to change the ongmal sequence m which they 
followed one another m the plam text, thus producmg cipher text Smce the first process consists 
of mscnbmg the text withm the design, it is techmcaUy referred to as the process of inscnptMn, 
and smce the second process consists of transcribii^ the text from the design, it is techmcaUy 
referred to as that of transcnption Either or both processes may be repetitive, by prearrange¬ 
ment of course, m which case the mtermediate steps may be referred to as processes of rescnphon, 
or rescnptive processes 

b It IS hardly necessary at this pomt to give the student any mdications as to how to 
differentiate a transposition from a substitution cipher If a review is necessary, however, he 
IS referred to Section IV of Mihtary Cryptanalysis, Part I 

3. Monophase and polyphase transposition —a As may be mferred from the foregoing 
defimtions, when a transposition system mvolves bift a smgle process of mscnption, foUowed by 
a smgle process of transcnption, the system may be referred to as monophase transpositwn, 
commonly caUed single transposition When one or more rescnptive processes mtervene between 
the ongmal mscnption and the final transcription the system may be referred to as polyphase 
transposition As a general rule, the solution of the latter type is much more difficult than the 
former, especiaUy when the successive transpositions are theoretically correct m pimciple 

b Any system which is smted for monophase transposition is also usuaUy smted for polyphase 
transposition, the processes of mscnption, rescnption and transcnption being accomplished 
with the same or with different keys 


Section II 


SOLUTION OF SIMPLE TRANSPOSITION CIPHERS 

Simple types of transposition.. . .. . 

The principles of solution of uniliteral roiite-traubpo'itioii cipheris . 

Keyed columnar transposition with complctelv-filled rectangles. 

Example of solution. 

The probable-word method of solution . .. 

General remarks on bolution ... 

Reconstruction of literal key . 

Column and row transposition - --- - —-— - -- 

4 Simple types of transposition — a The simple cases of reversed wntmg, vertical wntmg, 
or rail fence wntmg hardly require senous attention, smce they may be solved almost by mspec- 
tion These methods are mcluded here only because they may be encountered m censorship 
operations 

b The low degree of cryptographic secunty afforded by these methods may be mcreased to 
a slight degree by addmg nuUs or by disguismg the ongmal word lengths, and regroupmg mto 
false words or mto groups of regular length 



e Some examples of these sunplest types of transposition foUow Let the message be 
BRIDGE DESTROYED AT ELEVEN PM 

(1) Eeversmg only the words and retammg ongmal word lengths 

Cipher... EGDIRB DEYORTSED TA NEVELE MP 

(2) Reversmg only the words and regroupmg mto false word lengths 

Cipher.. EGDIRB DEYORT SEDTA NEVE LEMP 

(3) Reversmg the whole text and regroupmg mto fives 


EDEGU DIRBM 


sage becomes 


BSRTI RDOGY EEDDE, or 

BIGDS RYDRD EETOE 



G D I R B 


every fifth position 


0 R T S L 


g 

B S 

B R 

8- 

R T 

I D 


I R 

G E 


D 0 

D E 


G Y 

S T 


E E 

R 0 


D D 

Y E 


E 

D 


These simple types can be solved merely by mspection 

6. The pnnciples of solution of uniliteral route-transposition ciphers—o The so-called 
unihteral route-transposition methods are next to be exammed The solution of cryptograms 
enciphered by these methods is a matter of expenmentmg with geometnc figures, usually rec- 
(3) 
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angles, of various dimensions suggested by the total number of letters in the message, then 
nspectmg these rectangles, searchmg for whole words or the fragments of words by readmg 
horizontally, diagonally, vertically, spirally, and so on ‘ (See Special Text No 165, Elementary 
MiMary Cryptography, 1935, para 20, 21) 

b The amount of experimentation that must be performed m the solution of ciphers of tliia 
type may be matenally shortened hy means of formulae and tables constructed for the purpose 
But because ciphers of this type are of mfrequent occurrence today, these formulae and tables 
are only occasionally useful and hence they have not been mcluded m tbia text * 

6 Keyed columnar transposition with completely-filled rectangles —a In practical cryp¬ 
tography, the dimensions of the transposition rectangle, as a general rule, cannot vary between 
large Imuts, that is, it can be assumed m practice that rectangles based upon Imes of wntmg 
contammg less than 5 letters or more than 25 letters will not commonly be encoimtered If the 
width, that IS, the number of columns, is determmed by a key, then the number of rows becomes 
a function of the length of the message to he enciphered If the latter is veiy long, longer than 
can be conveniently handled without too many errors, it is a common practice to break up a 
message mto two or more parts and treat each part as though it were a separate communication 
Such parts are commonly termed seetwns 

b When the last row of a transposition rectangle is completely filled, the solution of the 
resultmg cryptogram is considerably more simple than when this is not the case* Conse¬ 
quently, this will the constitute first case to be studied 

‘ It IS interesting to observe that Daniel, of Biblical fame, was apparently the first cryptanalyst in history 
(as well as one of the earliest interpreters of dreams), for he solved the cryptogram in the “handwriting on the 
wall,” obtaining as his decipherment words which he interpreted as predicting the downfall of Belshazzar and 
his dynastv (Daniel V 1-28) The following partial account of the episode is not as enlightening as one might 
wish, but it IS probably the best explanation available It is taken from Dr Max Seligsohn’s article on the sub" 
jeetm The Jewish Encyclopedia, v6l 8, pp 490-491 (1926'> “MENE, MENE, TEKEL, UPHARSIN (fOIW W») 

Words written by a mysterious hand on the walls of Belshazzar’s palace, and interpreted by Daniel as predicting 
the doom of the King and his dynasty The incident is described as follows Once when King Belshazzar was 
banqueting with his lords and drinking wine from the golden vessels of the temple of YHWH, a man’s hand was 
seen writing on the wall certain mvstenous words Frightened bv the apparition, the King ordered his astrol¬ 
ogers to explain the inscription, but they were unable to read it Daniel was then summoned to the Royal 
Palace, and the King promised him costly presents if he could decipher the inscription Daniel read it “ Mene, 
mene, tekel, upharsm,” and explained it to mean that God had “numbered” the Kingdom of Belshazzar and 
brought it to an end, that the King had been weighed and found wanting, and that his Kingdom was divided 
and given to the Medes and Persians 

The first question which presents itself to the critic, namely, why could the inscription be deciphered by 
Darnel onlv—engaged the attention of the Talmudists, who advanced vanous answers Certain of them 
concluded that the Hebrew writing had been changed in the time of Ezra, so that even the lews that were 
found in the royal court could not read an inscnption written in archaic characters But those who followed 
R Simeon in maintaining that the writing had not changed found other solutions for the problem, e g it was 
written in the crvptographio combination *3 each letter of each pair being substituted bv its companion, 
e g unn nz no* nij», or the words were written thus pVMt ’npn OWBB, one above the other, having to be 
read verticaUy, or Hi'n'l tip? DW n», each word backward, or again, roiw ^np “M the first two lettera of 
each word being transposed (Sanh 22a) It is evident that the author of the Book of Daniel meant that the 
inscription was written in characters familiar to the King and wise men of Babylon, but that, as often happens 
with ancient inscriptions, the transposition of certain letters baffled every attempt to decipher them ” 

* See Lohr, Lenox R and Friedman, Wilham F , Formulaefor the solution of transposition ciphers Riverbank 
Pubhcation No 19, Geneva, Illinois, 1918 

• See Special Text No 165, EUmentary Military Cryptography, 1935, Sec V In this text the term “trans¬ 
position rectangle” will be used to designate the matnx, frame, cage, or design regardless of whether the latter 
IS completely filled or not 
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e In solving a cryptogram of this type the first step taken by the cryptanalyst is to ascerCam 
the dimensions of the rectangle Clues for this are usually afforded by findmg the factors of 
the total number of letters m the cryptogram Suppose the cryptogram contams 152 letters 
The dunensions of the transposition rectangle may be 4X38 or 8X19, by which is meant that 
four hypotheses may be made with respect to its dimensions The rectangle may consist of 

(1) 4 columns with 38 rows, or 

(2) 38 columns with 4 rows, nr 

(3) 8 columns with 19 lows, oi 

(4) 19 columns with 8 rows 

In practical work it is rather unlikely to encounter a rectangle that conforms to hypothesis (1) 
or (2), and foi the present these may be discarded As to choosing between hypotheses (3) and 
(4), a rather simple test to be described presently will disclose which is the more probable 

d It IS obvious that if the cryptogram is transcribed withm a rectangle of the correct dimen¬ 
sions, the letters m each row will be the ones which actually were m those rows m the original 
transposition rectangle and formed good plam text therem In jacl, the rows of letters in the 
correkly-dimensioned redangle wovld read plain text were it not for the transposition which they have 
undergone imthin the rows Therefore, the rows of a correctly-dimensioned rectangle are more 
likely to manifest the expected vowel-consonant proportions of normal plam text than are the 
rows of an mcoirectly-dimensioned rectangle, because m the latter case there are brought mto 
some of the lows letters which belong to other rows and which are likely to disturb the normal 
vowel-consonant proportions of plam text That is, m an incorrectly-dimensioned rectangle 
some of the rows will have too many consonants and not enough vowels, m other rows this 
relationship will be reversed, whereas in a correctly-dimensioned rectangle each row will have the 
proper number of vowels and consonants Hence m solving an unknown cryptogram of this 
type, if a count is made of the vowels and consonants m the rows of rectangles of various probable 
dimensions, that rectangle m.which the rows show the best proportions of vowels and consonants 
IS most likely to be correct, and the one that should be tried first 

e Havmg ascertamed the correct dimensions of the rectangle by the foregoing procedure, 
the next step is to experiment with the columns of the rectangle, trymg to brmg together several 
columns which will then show “good” digraphs, tngraphs, or polygraphs m the rows formed by 
juxtaposing the columns This process of combining or matchmg columns m order to build up 
these fragments of plam text will heiein be referred to as anagramming * 

j The procedure is to select a column which has a good assortment of high-frequency letters 
n.TiH find another column which may be placed before or after the selected column to build up 
high-frequency digraphs m the rows, when such a pair of columns has been found, attempt is 
made to add another column before or after this pair to build up high-frequency tngraphs, and 
BO on, gradually budding up longer and longer polygraphs until entire words begin to appear m the 
respective rows of the rectangle In this process of anagramming, advantage may be taken 
of simple mathematical considerations such as adding the normal plam-text frequency values of the 
digraphs m the rows to assist m discardmg combmations which are on the borderline of choice 
However, it must be noted that the totals obtamed by simple addition of the frequency values of 

* The Standard Dictionary defines the word anagram as follows “(noun) 1 The letters of a word or phrase so 
transposed as to make a different w ord or phrase, as, ‘time’ and ‘mite’ are anagrams of ‘emit’ 2 \ transposition, 
mterchange ” As a verb, it is defined as “to anagrammatize, to make an anagram of, make anagrams ” (The 
construction of anagrams was a very widespread pastime in previous centuries See Wheatley’s Of Anagrams, 
London, 1862 ) A strict interpretation of the word would therefore confine it to oases wherein the letters to be 
rearranged already form bonafide words or intelligible phrases However, this would hardly be broad enough for 
crvptanalytic purposes As used m cryptanalysis the word is commonly employed as a verb to referto the proc¬ 
ess of rearranging the disordered letters of cipher text so as to reconstruct the original plain text 


the digraphs should be considered only as rough approximations or guides in weighmg probabil¬ 
ities in favor of one hypothesis as against another, for theoretically the probability of the simul¬ 
taneous occurrence of two or more independent events is the product, and not the sum, of their 
respective probabilities In most cases the calculation of products involves an amount of labor 
unwarranted by the results to be expected, so that simple addition of probabilities is usuaUy 
sufficient However, if tables of the logarithms of the probabilities are readily available, the 
addition of these loganthms becomes a simple matter and affords a more accurate guide in selec¬ 
tion of combmations produced in the anagrammmg process ® Once a set of four or five columns 
has been correctly assembled it is usually the case that the process may be completed very quickly, 
for with the placement of each column the number of remammg columns possible for selection 
dimmishes, toward the close of the piocess, when only two or three columns remain, their place¬ 
ment IS almost automatic 

g It IS desirable, as a final step, to try to reconstruct, if possible, the literal key from which 
the numerical transposition key was derived 

7 Example of solution —a Given the followmg cryptogram, the steps m solution will be 
set forth m detail 

CRYPTOGBiM (126 letteib) 

ILHHD TIEOE UDHTS ONSOO EEEEI OEFTR 

RHNEA TNNVU TLBFA EDFOY CAPDT RRIIA 

RIVNL RNRWE TUTCU VRAUO OOFDA ONAJI 

UPOLR SOMTN FRANF MNDMA SAFAT YECFX 

R T G E T A 

h The cryptogram contains 126 letters (factors of 126 2, 3, 6, 7,9,14,18,21), suggesting 
rectangles of 7X18 or 9X14 If the former dimensions are taken, the rectangle may have 7 
columns and 18 lows or 18 columns and 7 rows, if the latter dimensions are taken, it may have 9 
columns and 14 lows or 14 columns and 9 rows The factors of 126 do not, of course, preclude 
the possibility that the rectangle may be 6X21, that is, with 21 columns and 6 rows or 6 columns 
and 21 rows If no good results were obtamed by testmg rectangles of the dimensions indicated 
(7 X18 or 9 X14), then one would proceed to test rectangles 6X21 In the event that all tests on 
the basis of a completely-filled rectangle failed, then it would be assumed that the rectangle may 
be incompletely filled In making the vowel-consonant test described m paragraph 6d, it is 
advisable to base the count on the columns as well as on the rows of a rectangle, smee it is possible 
that the cryptogram was prepared by inscnbmg the plam text m rows and transcribing the text 
from the columns, or vice versa After examinmg a rectangle both horizontally and vertically, 
it IS often possible to discard various arrangements without further tests For example, at A 
in figure 1 there is shown a rectangle of 7 columns and 18 rows Now m a row of 7 letters there 
should be (7X40 percent=2 8) either 2 or 3 vowels, but rows 12 and 16 contain no vowels at all 
and rows 8 and 9 contam 5 vowels, row 16, 6 vowels It is concluded at once that this arrange¬ 
ment 18 highly improbable If the plam text had been inscribed vertically m this same rectangle, 
and then the rows had been transposed in formmg the cipher text, then m each column (18 letters) 
there should be (18X40 percent=7 2) about 7 vowels, but column 2 contains 11 vowels and col¬ 
umn 6 only 4 This likewise indicates that it is highly improbable that the message was msenbed 
vertically and the cryptogram foimed by transposing the rows But when the arrangement at 

» A suggestion for which the author IS indebted to Mr 4 W Small, junior crvptanahst in this office The 
pnnciple makes practicable the use of tabulating machinery for the purpose of speeding up and facilitating the 
matchmg of columns in the auagramming process 
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B in figure 1 is studied, it is not so easy to say at once that it is improbable For in 18 letters 
there should be about 7 yowels and none of the rows of this arrangement shows too great a 
departure from this expected number This possibility will haye to be explored further and it 
18 for the moment put aside If it be assumed that the message was msenbed vertically in the 
rectangle 18X7 and the rows subjected to transposition, there should be (7X40 percent=2 8) 
2 or 3 vowels m each column But smee several of the columns show rather considerable depar¬ 
tures from this expected number, it may be concluded that a vertical mscnption and honzontal 
transcription is not probable and this assumption may be elimmated Then the arrangements 
at C and D m figure 1 are studied in the same manner, with the result that at the end of the study 
the situation as regards the vanous assumptions is summarized as follows 
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7 X 18 


^ 1 2 3 4 5 6 7 


1 

I 0 N T T U M 

2 

L 0 N R C P A 

3 

H E V R U 0 S 

4 

H E U I V L A 

5 

D E T I R R F 

6 

T E L A A S A 

7 

I I B R U 0 T 

8 

E 0 F I 0 M Y 

9 

0 E A V 0 T E 

10 

E F E N 0 N C 

11 

U T D L F F F 

12 

D R F R D R X 

13 

H R 0 N A A R 

14 

T H Y R 0 N T 

15 

S N C W N F G 

1 16 

0 E A E A M E 

17 

N A P T J N T 

18 

S T D U I D A 

IM umber ofj 7 ^ g 6 10 4 7 


A 


■s 

fe-l 

€ 

3 

2 

3 

4 
2 
4 

4 

5 

5 
3 
1 
0 
3 
2 
0 

6 
1 
3 


I 18 X 7 II 

“ 1 2 1 4 8 6 7 8 9 10 a 12 13 14 15 16 17 18 5^ 

1 lESETTBYRNTAAPTMFX 6 

2 LOOERNFCILUUOONNAR 9 

3 HENERNAAIRTONLFDTT 6 

4 HUSIHVEPANCOARRMYG 7 

5 DDOONUDDRRUOJSAAEE 9 

6 THOEETFTIWVFIONSCT 6 

7 ITEFALORVERDUMFAFA 8 

Number ofl „ ^ ^ ' 

vowels /■" 244621324125521232 

B 


9 X 14 



14 X 9 


PS 

1 

2 

3 

4 5 6 7 8 9 

10 

n 

12 13 

14 

i 

I 

E 

0 

F N E T N T 

0 

U 

N M 


2 

L 

U 

0 

T N D R L C 

F 

P 

F A F 

3 

H 

D E 

R V F R R U 

D 

0 

R S 

X 

4 

H 

H 

E 

RUOINVAL 

A A 

R 

5 

D 

T 

E H T Y I R R 

0 

R 

N F 

T 

6 

T 

S 

E 

N L C A W A 

N 

S 

F A 

G 

7 

I 

0 

I 

E B A R E U 

A 

0 

M T 

E 

8 

E 

N 

0 

A F P I T 0 

J 

M N Y 

T 

9 

0 

S 

E 

T A D V U 0 

I 

T 

D E 

A 


D 


6 

3 

3 
7 

4 
4 

10 


8 




Rectangle 7 X 18 


7 columns and 18 rows 

(1) Horizontal inscription, columnar transcription...... Very improbable 

(2) Vertical mscription, horizontal transcription... Very improbable 

18 columns and 7 rows 

(3) Horizontal mscription, columnar transcription... Possible 

(4) Vertical inscription, horizontal transcription.. . ..Improbable 


Rectangle 9 X 14 


9 columns and 14 rows 

(5) Horizontal msciiption, columnar transciiption_ 

(6) Vertical mscription, horizontal transcription.. 

14 columns and 9 rows 

(7) Horizontal mscription, columnar transcription .... 

(8) Vertical mscription, horizontal transcription.... .... 


Possible 

Improbable 

Improbable 
Very improbable 


c Discarding all assumptions except (3) and (5), the latter are subjected to further scrutmy 
Suppose the average amount of deviation from the expected number of vowels m each row is 
calculated by findmg the difference between the actual and expected numbers m each row, 
addmg these differences (neglectmg signs), and dividmg by the total number of rows For as¬ 
sumptions (3) and (5) the results are as follows „ ^ ^ 


18 X 7 



1 2 

3 

4 

5 6 7 

8 9 10 11 

12 

13 

14 

15 16 

17 18 

1 

1 

I E 

S 

E 

T T B 

Y R N T 

A 

A 

P 

T M 

F X 

6 

2 

L 0 

0 

E 

R N F 

C I L U U 

0 

0 

N N A R 

9 

3 

H E 

N E 

R N A A I R T 

0 

N 

L 

F D 

T T 

6 

4 

HUS 

I 

H V E 

PANG 

0 

A 

R R M 

Y G 

7 

5 

D D 

0 

0 

N U D 

D R R U 

0 

J 

S 

A A 

E E 

9 

6 

T H 

0 

E 

E T F 

T I W V 

F 

I 

0 

N S 

C T 

6 

7 

I T 

E 

F 

A L 0 

R V E R 

D 

U 

M 

F A 

F A 

8 


1 2 

1 8 

1.2 


1 8 
1,2 
8 


Total deviation=8 2 
Average deviation=1 2 

FiavBn U 
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9X14 

123406786 

Number of vowels 

Deviation from 
expected number 

ISTBRTATF 

2 1 6 

LORFIUONA 

5 1 4 

HNRAITNFT 

2 1 6 

HSHEACARY 

4 4 

DONDRUJAE 

4 4 

TOEFIVINC 

4 4 

lEAOVRUFF 

5 1 4 

EETYNAPMX 

4 4 

OENCLUONR 

4 4 

EENAROLDT 

4 4 

UIVPNORMG 

3 6 

DOUDROSAE 

5 1 4 

HETTWFOST 

2 1 6 

TFLREDMAA 

3 6 


Total deviation=12 6 
Average deviation = 9 


Fioube 1/ 


The average amount of deviation for assumption (5) is only 0 9 as against 1 2 for assumption 
(3), therefore the former assumption is considered to be somewhat better than the latter and it will 
be tried first 

d The columns of the rectangle shown in figure 1/ are now to be cut apart and the procedure 
of anagramming applied (For this it is best to have the cryptogram wntten on cross-section 
paper preferably with K-mch squares for ease in handlmg ) Consider column 7, with the letter 
J m row 5, this letter, if it is a part of a word, must be followed by a vowel, which eliimnates 
columns 1, 3, 4, and 5 as possibilities for placement on the right of column 7 Here are the 
digraphs formed by combmmg column 7 with columns 2, 6, 8, and 9, respectively, and the totals 
obtamed by addmg the frequency values of the digraphs formed m the rows 
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( The frequencies showi 

1 are as given in 

. table 6, 

appendix ti 

0 Military Cryptanalysts 

, Part I) 


(1) 

(2) 


(3) 


(4) 



& 


L 




& 


II 


P 


ll 


i| 

7 2 

£ 

7 6 

1 

7 8 


7 9 

£ 

A S„ 

...... 41 

A T..... 

47 

A T. 

... 47 

A F. 

4 

0 0... 

_ 6 

0 U_ 

37 

0 N. . 

. 77 

0 A.. 

7 

N N... 

_ 8 

N T. 

82 

N F... . 

9 

N T_ 

82 

A S... 

_ 41 

A C_ 

14 

A R....... 

44 

A Y. 

12 


2 

•T IT 

2 

J A.... 

1 

J E_ 

2 

I 0... 

_ 41 

I V.. 

25 

I N 

.. 75 

I C. 

22 

U E... 

11 

11 R 

31 

U F_ 

1 

U F_ 

1 

P E... 

.. 23 

P A_ 

14 

P M .. . . 

4 

P X. 

0 

0 E... 

. 3 

0 U_ 

37 

0 N. .. 

77 

0 R. 

64 

L E... 

_ 37 

L 0.. 

13 

L D ... 

9 

L T 

8 

R I... 

. 30 

R 0 . 

28 

R M....... 

9 

R G. 

7 

SO.. 

_ 15 

S 0. 

15 

S A. 

. 24 

S E. 

49 

0 E... 

_ 3 

0 F. 

25 

0 S. 

. 14 

0 T. 

19 

M F... 

. 1 

M D. 

1 

M A....... 

. 36 

M A. 

36 


Total... 262 Total_371 Total.... 427 Total.... 313 

Figure 2 

Combination (3) gives the highest frequency value for the digraphs and an attempt is made to 
add a column to it Here are some of the combinations tried 

781 782 783 789 

ATI ATS ATT ATF 

ONL ONO ONR ONA 

NFH NFN NFR NFT 

ARH ARS ARH ARY 

JAD JAO JAN JAE 

INT INO INE INC 

UFI UFE UFA UFF 

PME PME PMT PMX 

ONO ONE ONN ONR 

LDE LDE LDN LOT 

RMU RMI RMV RMG 

SAD SAG SAU SAE 

OSH OSE OST OST 

MAT MAF MAL MAA 

Fioube 3 

e Each of these combinations shows at least one “impossible” trigraph and several “poor” 
ones ® After more or less work along these lines, the cryptanalyst begins to get the feelmg that 
“somethmg is wrong,” for, as a rule, once a correct start has been made in cases of this kmd, 
solution comes rather quickly Hence, the cryptanalyst decides here that possibly his first 

• Following the steps taken m subpar d, frequency weights may be given the various trigraphs m fig 3 and 
the sums obtained taken as indications of the relative probability of each of the four trials These steps are here 
omitted, for they are obvious 
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choice of combination (3) was a bad one, even though it gave the greatest total when frequency 
values for the digraphs were summed The second greatest total was foi combmation (2) m 
which columns 7 and 6 were put together The mfrequent digraph J U suggests a word such as 
JUST or JUNCTION If it weie the former there should be a column contammg an S m the 5th row, 
and there is no such column If the word is JUNCTION, there should be a column containing an N 
m the 5th row, and there is only one such column, the 3d Placmg column 3 after columns 7—6 
gives the trigraphs shown m figure 4-A All of these tngraphs are excellent except the last, and 
that one may be either an abbreviation of a signature, or possibly nulls added to complete the rec¬ 
tangle If the word JUNCTION is correct then there should be a column with a C m the 5th row, but 
none is found However, column 9 has a C in the 6th row, and if it happened that the last column 
on the right is No 3, then column 9 would be the 1st column Thus, as shown m figure 4-B, the 


arrangement of columns becomes 9 

7 6 3 





ATT 

F 

ATT 

F I 

R S 

T B A T 

T 

OUR 

A 

OUR 

A L 

I 0 

N F 0 U 

R 

N T R 

T 

N T R 

T H 

I N 

F A N T 

R 

A C H 

Y 

A C H 

Y H 

A S 

R E A C 

H 

J U N 

E 

J U N 

E D 

R 0 

A D J U 

N 

I V E 

C 

I V E 

C T 

I 0 

N F I V 

E 

U R A 

F 

U R A 

F I 

V E 

FOUR 

A 

PAT 

X 

PAT 

X E 

N E 

M Y P A 

T 

0 U N 

R 

0 U N 

R 0 

L E 

N C 0 U 

N 

LON 

T 

LON 

T E 

R E 

D A L 0 

N 

R 0 V 

G 

R 0 V 

G U 

N I 

M P R 0 

V 

SOU 

E 

SOU 

E D 

R 0 

A D S 0 

U 

OFT 

T 

OFT 

T H 

W E 

S T 0 F 

T 

M D L 

A 

M D L 

A T 

E F 

A R M D 

L 


FIOUM riOVSI 4-B FIGCBI 8 


f It IS beheved that the procedure has been set forth with suflicient detad so as to make 
further demonstration unnecessary The rectangle can be completed very qmckly and is found 
to be as shown m figure 5 

g It will be mterestmg to see if a calculation based upon the sum of the loganthms of the 
probabilities given in figure 2 would have given the correct combination as the first choice 
Note the results shown m figure 6 This calculation gives the correct combmation as first 
choice, VIZ, 7-6, with a logarithmically-weighted value of 17 35 as agamst a value of 16 51 for 
combmation 7-8, which was the first one tned on the basis of merely the sums of the frequency 
values of the digraphs 
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(1) 



(2) 



(3) 



(4) 




1 


If 



& 

u 

1 



1 



1 



1 


I1 

1 


P 

1 








s 


7 8 


5 

A S,.. 

.. 41 

1 61 

A T_ 

47 

1 67 

A T 

47 

1 67 

A F 



0 0... 

6 

78 

0 U._ 

37 

1 57 

0 N.... 

77 

1 89 

0 A 

7 


N N... 

8 

90^ 

N T. 

82 

1 91 

N F_ 

9 

95 

N T_ 

82 

1 9] 

A S._ 

- 41 

1 61 

A C_ 

14 

1 15 

A R.... 

44 

1 64 

A Y_ 

12 

1 08 

J 0... 

2 

30 

J U. .. 

2 

30 

J A.... 

1 

00 

J E. .. 

2 

30 

I 0... 

. 41 

1 61 

I V_ 

25 

1 40 

I N.... 

75 

1 88 

I C.... 

22 

1 34 

U E„ 

_ 11 

1 04 

U R._ 

31 

1 49 

U F._ 

1 

00 

U F_ 

1 

00 

P E._. 

.. 23 

1 36 

P A .... 

14 

1 15 

P M._ 

4 

60 

P X..... 

0 

—1 00 

0 E... 

3 

48 

0 U.... 

37 

1 57 

0 N.... 

. 77 

1 89 

OR., 

64 

1 81 

L E... 

. 37 

1 57 

1 L 0 .. . 

13 

1 11 

L D ... 

9 

95 

L T_ 

8 

90 

R I.... 

- 30 

48 

R 0.... 

28 

1 45 

R M... 

g 

95 

R G 

7 

85 

S 0.... 

.. 15 

1 18 

S 0_ 

15 

1 18 

S A... 

24 

1 38 

S E..... 

49 

1 69 

0 E„ 

3 

48 

0 F._ 

25 

1 40 

0 S..... 

14 

1 15 

0 T_ 

19 

1 28 

U F.„. 

1 

00 

M D .... 


00 

M A ... 

36 

1 56 

M A_ 

36 

1 56 

Total. 

.. 262 

13 40 

Total— 

371 

17 35 

Total... 

. 427 

16 51 

Total... 

313 

13 17 


FlOtJB* « 


As a mattei of interest, it may be observed that the combmation 7-6 is 7 times more probable 
than combination 7-8, smee the diffeience between 17 35 and 16 51 is 84, which is the logarithm 
of 7 Likewise, combmation 7-6 is roughly 15,000 times more probable than combination 7-9, 
smee 17 35-13 17=4 18 

8 The probable-word method of solution —a The probable-word method of attack is as 
important m the solution of transposition ciphers as it is m the solution of substitution ciphers, 
and if the cryptanalyst is able to assume the presence of such probable words as are usually 
encountered m mihtary commumcations, the solution, as a rule, comes very qmckly 

b As an illustration, lookmg at the first row of letters m the rectangle shown m figure If, 
the letters ISTBRTATF almost at once suggest FIRST BATTALION as the imtial words of the 
message A rearrangement of the columns of the ciyptogram to bnng the necessary letters 
mto juxtaposition at once discloses the key Thus 

815284783 

FIRSTBATT 

ALIGN 

It will be noted that this assumption reqmres that there be a column headed by F A, another 
headed by I L, another headed by R I, and so on Had such columns not been found, then the 
word BATTALION would not be possible In that case the word FIRST would still remam as a 
pomt of departure for further experimentation 

c In the foregoing illustration, the probable word was assumed to appear m the first Ime 
of text in the rectangle If the probable word being sought is m the mtenor of the message, the 
steps must be modified somewhat but the basic principle remams unchanged The modifications 
are of course obvious 

9 General remarks on solution .—a In solvmg transposition ciphers advantage should be 
taken of all the characteristics and idiosyncrasies which are applicable to the language of the 

324165—41-2 
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enemy, because they often afford clues of considerable assistance to the cryptanalyst In all 
languages there are certain letters, usually of medium or low frequency, which combme with 
other letters to form digraphs of high frequency For mstance, in English the letter H is of 
medium frequency, but it combines with T to form the digraph T H, which is of highest frequency 
m literary text, it also combines with C, a letter of medium frequency, to form the fairly frequent 
digraph C H The letter V is almost m the low-frequency category yet it combmes with E to 
form the digraph V E, which m military text is the 14th m frequency The low-frequency letter 
K often combines with C to form the digraph C K Consequently, m working with transposition 
ciphers in English, when there is an H, attempts should be made to combme it first with a T or 
with a C, a V should be combmed first with an E, a K should be combined first with a C, and so on 

h There is usually m every language at least one letter which can be followed by only a 
certam other letter, formmg what may be termed an obligatory sequence, oi an invariable digraph 
In all languages havmg the letter Q, the combmation Q U constitutes such an mvanable digraph ^ 
In bonafide words of the German language the letter C is never used by itself, when present the 
lettei C is mvariably followed by an H, except on rare occasions when the digraph C K is employed 
In English, the letter J can be followed only by a vowel, the letter X can only be preceded by a 
vowel and, except at the end of a word, can only be succeeded by a vowel, or by one of a limited 
number of consonants (C H P T), and so on Letters which behave m this manner, that is, 
letters which have what may bo called a limited affinity m combuung with other letters to form 
digraphs, constitute good pomts of departure for solution and are therefore of sufficient impor¬ 
tance to warrant their bemg designated by the more or loss descnptive name of pilot letters 

e The presence of pilot lettei s m a transposition cipher often forms the basis for the assump¬ 
tion of probable words Obviously, a special lookout should be kept for words of rather high 
frequency (m military correspondence) which contam letters of low or medium frequency 
The frequent word CAVALRY, for example, would suggest itself if the cryptogram has the letters 
C, V, L, and Y, which are dl of medium frequency The important word ATTACK suggests 
itself if the cryptogram has a K, a letter of low frequency, and a C, one of medium frequency, 
and so on 

d The mechanics of simple columnar transposition make possible the production of rather 
long sequences of vowels and long sequences of consonants m the text of the cryptogram Note, 
for example, m the cryptogram on p 6, the sequence of vowels OOEEEEIOE, and the 
sequence of consonants VNLRNRW If the enciphoimg or plam-text rectangle is con¬ 
sulted, it will be seen that these two sequences belong together, that is, they are m adjacent 
columns m that rectangle It is a characteristic of plam text that consonant-vowel or vowel- 
consonant digraphs are much more frequent than consonant-consonant or vowel-vowel digraphs,* 
and therefore when long sequences of consonants and of vowels ore found m transposition 
ciphers, a good start toward solution may result from assummg that such sequences come from 
adjacent columns 

e. It should, however, be noted m connection with tell-tale letters such as Q (entermg mto 
the composition of Q U) and C (entermg mto the composition of C H), that astute cryptographers 
who realize the clues which such letters afford often replace mvanable digraphs by smgle char¬ 
acters, usually those rarely used in the language m question For example, C H in German may 
be replaced by Q, Q U m French, by K, and so on When this is done, solution is made more 
difficult, but only m those cases where it is dependent upon findmg letters formmg obligatory 
sequences m plam text does this sort of subterfuge become a factor of importance 

> The letter Q may, of course, be part of an abbreviation, such as SQ for "square,” or it may be used as a null, 
or as a sign of punctuation However, unless there are good reasons for behevmg that this letter is used for such 
purposes, QU may be considered to be an invariable digraph 

' The CV and VC digraphs constitute about 62 percent of all digraphs 
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/ The presence of many Q's, or K’s, or X’s in a transposition cipher should not, however, be 
taken as pnmafacw evidence of the type of replacement noted m the precedmg subparagraph 
It IS possible that such letters may be used as sentence separators or other punctuation, possibly 
they may be nulls, although the alert ciyptographer would either use nulls not at all or, if he 
had to, would use letters of medium or high frequency for this purpose 

g Because it is important that the cryptanalyst take advantage of every peculiarity specifi¬ 
cally apphcable to a cryptogram to be solved, especially as regards the presence of low-frequency 
letters, it is advisable that a uniliteral frequency distnbution be prepared, just as though he 
were gomg to deal with a substitution cipher This is probably the quickest way of brin g in g to 
hght the peculianties which may be helpful m solution 

10 Reconstruction of hteral key— a The reconstruction or recovery of the hteral key 
from which the numeiical transposition key was denved is naturally the last step in the solution 
of cryptograms of this type It is often of more than merely academic mterest, because if it is 
found that the enemy is employmg for this purpose some weU-known book, or words or phrases 
of a simple nature associated with the locale of operations, this fact may be of highest importance 
m subsequent work 

b In this process there are only a few guiding pnnciples to be noted and much must be left 
to the mgenuity and imaginative powers of the cryptanalyst Taking as an example the numer¬ 
ical key uncovered m the solution of the cryptogram m paragraph 7, the procedure will be set 
forth below 

e The numencal key referred to was found to be 915284763 Assummg that this 
sequence was denved m ^e usual manner, by assigning numbers to the letters of a key word m 
accordance with their relative positions m the normal alphabet, the sequence forms the basis for 
the key-word reconstruction diagram shown m figure 7-A, m which the individual key numbers are 
wntten from left to nght on different “levels” so that each level contains only numbers normally 
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DE 
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ABC 

DE 
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DE 
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FGH 

IJ 
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KLM 

NO 

5 
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NO 
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L^N 
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MNO 
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E-Z 
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d It IS hkely that the digit 1 on the first level m the key-word reconstruction diagram 
represents a letter at or at least close to the beginning of the alphabet Since the digits 2 and 3 
are on the same level as the digit 1, it is likely (1) that the letter represented by 1 occurs 2 more 
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times m the key word, or (2) that the digit 2 represents another letter, also near the beginmng of 
the alphabet, and that this letter is repeated, or (3) that the digits 2 and 3 represent 2 different 
letters both near the beginning of the alphabet, or (4) that all three digits represent different 
letters but all near the beginning of the alphabet The digit 4, on the second level in the recon¬ 
struction diagram, must represent a letter beyond the letter represented by the digit 3, the digit 
5 must represent one beyond the letter represented by the digit 4, and the digit 6 may represent 
the same letter as 5, or a letter not much beyond that represented by 6 Assuming that the 
letters composing the key word are fairly well distributed over the entire alphabet, the digit 7 
must represent a letter near or slightly beyond the middle of the alphabet, the digit 8 must repre¬ 
sent one further toward the end of the alphabet than does the digit 7, and so on Aaaigning 
several values to the digits, m accordance with the foregoing pnnciple, the results are as shown 
m figure 7-B 

e It IS perhaps possible that some students may find the process of reconstructmg the literal 
key somewhat easier if the variant possible letters are merely listed imder the respective key 
numbers as shown in figuie 7-C The candidates for the successive positions m the literal key 
thus appear m a rather condensed space and the eye is able to pick up “good” combinations 
very quickly 

91S284783 

RAKAMFLKA 

SBLBNGMLB 

TCMCOHNMC 

UDNDPIOND 

VEOERJPOE 

W 

X 

y 

z 

FlOCU 7-0 

J Now comes the trymg process of findmg a “good” word m this assemblage of letters The 
begmnmg and end of the word are the easiest pomta of attack, and it is useful to keep m mind the 
relative frequency order of letters as uutial and final letters of the language m question For 
Enghsh, the data are as follows * 

As mitial letters-T SAFCORDNPEMIWBHLUGYVJQKZX 

As final letters-E TDSNYROHLAFGPMXCKWUBIZQJV 

Studying the candidate letters at the end of the key, it is seen that E is one of the possibilities 
If that IS correct, then a good ending would be one of the type vowel-consonant-vowel, with E as 
the final letter There is but 1 vowel in the fourth level m the column under the digit 7, the 
letter 0 This gives 0 K E, 0 L E, 0 M E, 0 N E as possible termmal trigraphs, the best of which 
from a frequency standpomt is ONE Seemg the letters P and H in columns 8-^, the ending 
PHONE and then the word TELEPHONE suggests itself Checkmg to see if there are any incon¬ 
sistencies, none is found and the solution is 


g In future studies, cases will be encountered wherem the reconstruction of the numerical 
key IS an essential or, at least, a useful element after the solution of one or more cryptograms has 
been achieved by cryptanalysis This is done in order that subsequent cryptograms m the same 
key can be read directly without cryptanalysis The reconstiuction of the numerical key is, 
however, a different process than the one illustrated m this paragraph, wherein the problem is 
solely one of building up a hteral key from its numerical equivalent The purpose in reconstruct¬ 
ing ^e hteral key is to give clues as to the source from which keys are derived or taken Some¬ 
times this may lead to ascertaining a book which is used for this purpose and which may be 
available by purchase at bookshops, or it may be a well-known document, a telephone directory, 
etc Obviously, if the source document or book can be located the solution of future crypto¬ 
grams m the same system becomes merely a matter of decipherment and such crj ptograms no 
longer form the matenal for cryptanalytic efforts The method of reconstructing the literal 
key IS, obviously, easier to apply m the case of long numerical keys than in the case of short ones, 
m general, the longer the numerical key the easier is the recovery of the literal key 

11. Column and row transposition —It should be obvious that when the rows as well as 
the columns of a completely-filled rectangle undei^o transposition the increase in security is 
hardly worth mention, smee the underlying procedure m solution aims simply at assembling a 
few columns on the basis of “good” digraphs and trigraphs brought to hght by juxtaposing 
columns After three or four columns have been properly juxtaposed, the placement of addi¬ 
tional columns becomes easier and easier, merely by continuing to build upon the fragments of 
words %n the rows Hence, the cryptanalyst is, during a large part of the process, not particularly 
mterested m the mtelhgibility of the text he is buildmg up, only at the end of the process does 
this become a factor When all of the columns have been assembled in proper order, then the 
text wfil read continuously in the normal manner (left to nght, top to bottom) If it does not, 
then it 18 usually a very simple matter to rearrange the rows of the rectangle to bring this about, 
since the letters at the ends and begimungs of the rows give the necessary clues for contmuity 



Numencalkey_9 15284763 

_ Literal key.....T ELEPHONE 

• Taken from Tables 2-D (2) and 2-E (2), p 111, Military Cryptanalysu, Part 1 
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12 General principles underlying solution —a In the system designated keyed columnar 
transposition the feature which differentiates an mcompletely-hllcd rectangle from one that is 
completely filled is a very simple one from the cryptographic point of view The bottom row of 
the rectangle m the former case merely lacks one or more letteis, a featuie which only very 
slightly complicates the system in practical opeiation But the consequences of this simple 
difference between the two types are, from the cryptanalytie point of view, quite piofound, and 
the cryptanalytie effect of this small change m cryptographic procedure is seemingly all out of 
proportion with the simplicity of the difference 

b Cryptograms mvolvmg completely-filled rectangles are i ather easy to solve because of two 
circumstances In the first place, smee the rectangle is completely filled, the various possible 
dimensions of the rectangle can be ascertained by noting the factors of the total number of letters 
Usually only a few possibdities are indicated and thei efore this matcnally reduces the amount of 
experimentation that would be lequircd m the absence of this situation, since it is obvious that 
when working with mcomplctely-filled lectanglcs a good many rectangles of various dimensions 
become possibdities for tiial In the second place, the columns m a completely-fiUcd rectangle 
all contain the same numbei of letters, and therefore the anagramming process (matching and 
assembling of columns) can be performed without any mental i eservations such as must be made 
m working with incompletely-filled lectangles because of unccitamty as to whether the letters 
which are juxtaposed to form digraphs and tiigiaphs leally tome fiom the same low m the plain¬ 
text rectangle The latter statement calls for a bit moie explanation 

c The columns of an incompletely-filled rectangle arc of two soits which may convcmently 
be designated as long and short The long columns are at the left of the lectangle and each one 
(xmtams just one more lettei than the short columns, which arc at the right This follows, of 
couise, from the fact that it is only the last low m such a lectangle which lacks one or more letteis 
to complete the rectangle The term smdth, as applied to a transposition rec tangle, will be con¬ 
venient to designate the number of columns, which is, of course, determined by the length of the 
numerical key or the number of letteis m the literal key Given the width of the rectangle and 
the total number of letters m the cryptogram, the length and number of the long and the short 
columns may be found by a simple calculation Multiply the width of the rectangle by the 
smallest number which will yield a pioduct greater than the total number of letters m the 
cryptogram The multiplier gives the length of the long columns, this multiplier mmus 1 gives 
the length of the short columns, the excess over the total number of letters gives the number of 
short columns, the latter deducted from the width gives the number of long columns Thus, 
with a cryptogram of 287 letters and a rectangle 15 columns m width [(15X20)-13=2871 the 
(18) 


long columns will have 20 letters, the short ones, 19 letters, there will be 13 short columns and 2 
long ones 

d Now if the ciyptanalyst were able to cut up the text of a cryptogram produced from an 
incompletely-filled rectangle into sections correspondmg in length with the actual long and short 
columns, he could handle these columns m exactly tlie same manner that he handles the equal- 
length columns m the solution of a cryptogram produced from a completely-filled rectangle In 
fact, the solution would be easier because he knows that all tlie short columns fall at the right, 
all tile long columns at the left of the transposition rectangle, and therefoie the amount of oxpen- 
mentation he must undertake m his attempts to juxtapose columns m the anagramming process is 
considerably reduced But, unfortunately, there is usually no way m which, at the initial stage 
of solution, the cryptanalyst can find out, fiom a single ciyptogiam, which aie the long columns 
and whidi the short This is obviously a matter directly connected with the specific transposi¬ 
tion key, and the latter is the sole unknown factor m the whole problem 

e If it were practicable to transciibe a cryptogram of this type according to all the possible 
transposition keys for a given width of rectangle, solution would obviously meicly consist m 
sc anning the vanous rectangles to find the one which is correct—for there will be only one such 
rectangle A rectangle 15 columns m width may have been enciphered by any one of factorial 
15 transposition keys * Wlule it is conceivable that machmery might be devised foi this purpose, 
so that the production of the millions of possible rectangles could be effected m a relatively short 
time, m the present state of the art no such machinery has yet been devised Fuitheimore, it is 
problematical whether a solution by such means could be achieved m a leasonable length of time 
even if the machmery were available, because of the immensity of the task it would have to 
perform * 

/ However, this question may be asked Given a cryptogiam of t letters and a ri ctangle of 
n columns m width, is it possible to transciibe the text within a single rectangle so that the latter 
wiU show what letters will constitute the respective columns for all possible transposition keys of 
n elements? If so, then such a rectangle would be useful m trying to solve the cryptogram, 
because the rectangle would then limit the amount of experimentation that would have to be 
performed by the anagramming process, since it would show whether or not two letters which 
are brought together m that process to form a digiaph could possibly have been m the same row 
m the plain-text rectangle If not, then of course there would be no use in forming such digi aphs, 
and thus the numbei of trials becomes much reduced Another way of mdicating what is meant 
IS to say that suih a rectangle would show the maximum amount that one column may be shifted 
up or down m trying to match it with another column m the anagramming process This will be 
made clearer m a subsequent paragraph At this pomt it will merely be stated that it is easy to 
prepare a rectangle of the nature indicated above for any keyed, columnar-tiansposition 
cryptogram 

* Factorial 15, or 15X14X13X X1, equals 1,369,944,576,000 different transposition keys 

* It is nevertheless pertinent to indicate that machinery for facilitating the “matching” or anagramming of 
columns has been devised and found to be quite practical in the solution of problems invohing columnar trans¬ 
position 
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13 Delimitmg the lengths of the columns of the rectangle, cnnat.rnc t.iTig the “hat" dia¬ 
gram —a Given the following cryptogram of 224 letters and an assumed width of 12 columns 
in the enciphering rectangle 

Cryptogram 


0 D N N P 
D S T E 0 
M S C L C 
F M B I E 
T N D A H 
E A 0 0 T 
A E N E E 
A L 0 D I 


T I R N T 
I T D M A 
S 0 E F C 
H B V T B 
I R H Q I 
H E A C N 
M Y T F I 
R 0 R Y N 


D T U R 0 
N L N 0 E 
F F T E E 
E S R S Y 
E T E T N 
S H E E V 
T A N L N 
N R G Y 


E X A L N 
B 0 U H E 
E M I A I 
L X R 0 R 
0 T R A A 
T R E S R 
N U A C L 


I E T G N 
N L E S E 
T E A I J 
U M E T Y 
V R I R S 
A I I E A 
R E N R T 


W T T M E 
A A C T R 
N S 0 I V 
0 I K N K 
T G S E F 
T E E A L 
R A T S 0 


DISTRIBimON 


ABCDEFGHIJKLMNOP 

18 4 e s SI 6 3 6 16 1 2 9 7 20 16 1 


g g g 

-ggggg-.^g 

QRSTUVWXY 

1 18 12 26 4 4 1 8 6 


Z 

0 (224) 


6 A cryptogram of 224 letters and a rectangle of 12 columns [(12X19)—4 =224] mdicates 4 
short columns of 18 letters and 8 long columns of 19 letters The outlmes of a rectangle of this 
specification are drawn on a sheet of cross-section paper and the text is transcnbed withm it, 


of numbers 1 to 12 Thus 


1 2 3 4 6 0 7 8 9 10 11 12 

ONMCMHYTOAFA 

DIATIBONOIIT 

NENRAVIOTITS 

NTLMITKTHEAO 

PGNSTBNREANA 

TNOCEEKAATLL 

IWELASTACENO 

RTBCIRNVNEND 

NTOSJSDRSAUI 

TMUONYAIHLAR 

DEHESLHREACO 

TDEFOXISEELR 

USNCIRRTVNRY 

RTLFVOHGTEEN 

OEEFFRQSRENN 

EOSTMUIEEMRR 

XIEEBMEFSYTG 

ATAEIETERTRY 

LDAEETEA 


FioobiS 


e The rectangle shown m figure 8 is the same as though it had been assumed that the key 
numbers 9, 10, 11, and 12 happened to fall at the extreme right m the numerical transposition 
key Columns 1 to 8, mclusive, would then be long columns, and columns 9,10,11, and 12 would 
be short columns But suppose that the key numbers on the extreme right happened to be 1, 2, 
3, and 4, mstead of 9, 10, 11, and 12 Then columns 1, 2, 3, and 4 would be the short columns, 
6 to 12 the long ones In this case, makmg reference to figure 8, the final letter of column 1 
would pass to the top of column 2, the final 2 letters of column 2 would pass to the top of column 

3, the final 3 letters of column 3 would pass to the top of column 4, the final 4 letters of columns 

4, 5, 6, 7, and 8 would pass to the top of columns 5, 6, 7, 8, and 9, the final 3 letters of column 
9 would pass to the top of coliunn 10, the final 2 letters of column 10 would pass to the top of 
column 11, and the final letter of column 11 would pass to the top of column 12 The results of 
the foregomg reasonmg are embodied m the matrix or diagram shown m figure 9 

1 2 8 4 6 6 7 8 9 10 11 12 

1 t m u 1 0 

2 eebmefe 

3 taeietesy 

4 Idaeeteartr 

5 ONMCMHYTOAFA 

6 DIATIBONOIIT 

7 NENRAVIOTITS 

8 NTLMITKTHEAO 

9 PGNSTBNREANA 

10 TNOCEEKAATLL 

11 IWELASTACENO 

12 RTBCIRNVNEND 

13 NTOSJSDRS ACjL^I 

14 T M(g)0 NYAIHLAR 

15 DEHESLHREACO 

16 TDEFOXISEELR 

17 (5)S NCIRRTVNRY 

18 RTLFVOHGTEEN 

19 0 E E FFRQSR E N N 

20 E O^T M(y)I E E[M R R 

21 X ifE E B M E F S y|T G 

22 aJt"a e I e t e r t r|y 

23 LDAEETEA 

FlOOBB 9 

d Now the capital letters m this matrix or diagram, which is often called a crown or hat 
diagram,* figure 9, represent the Ijltters which are in the columns in case the firot hypothesis 
(key numbers 9, 10, 11, 12 at the extreme right) is true The capital letters ebove the heavy 
black hne together with the lower-case letters at the top of the diagram represent the letters 
which are in the columns in case the second hypothesis (key numbers 1, 2, 3, 4 at tho extreme 
right) 13 true Therefore, since the hat diagram covers the two possible extremes with reference 
to the positions occupied by the short columns and embraces all possible mtermediate conditions 
by showing what letters may be m the respective columns under any possible arrangement of long 
* Because the lower-case letters at the top form what is usually called the crown or hat 
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and short columns, the hat diagram is applicable to any possible numerical key jor the cryptogram 
in question and for the assumed width of rectangle Therefore, in the anagrammirg process the 
hat diagram shows the maximum possible amount that any column may be shifted up or down 
in juxtaposing two columns to form digraphs of letters assumed to come from the same row 
m the plain-text rectangle This is because all the letteis of the first row of the actual enci- 
phermg rectangle wiU be found m rows 1 to 5, inclusive, of figuie 9, all the letters of the second 
row of the rectangle will be found in lows 2 to 6, inclusive, and so on, as indicated by the braces 
at the right in figure 9 

e Thus there arises the followmg important pimciple Designatmg the number of short 
columns in a specific diagram by n, only such letteis as fall vithm (n+1) consecutive rows, will 
be letteis that may have appeared m the same row m the actual transposition rectangle Or, 
another way of statmg the prmciple is this Both members of any pair of letteis actually m the 
same row m the transposition lectangle will be found only among the letters appearmg in (ra+1) 
consecutive rows in the coriect hat diagiam In the case iindei discussion, if the first letlei 
of such a pair is located in row 8, for example, the other letter cannot be in rows 1,2 3, or 13 to 
23 of figure 9 

/ The usefulness of this principle in connection with the coiistinotion and emplojnient of 
the hat diagram will soon become apparent For example, again referring to figure 9, take the 
lettei Q in row 19, column 7, it must be followed by a U in the plam text There are 4 U’s m the 
message they are in low 13 column 11, row 14 column 3, row 17 column 1, and row 20 column 6 
GJ Now the question is, can any of these 4 U’s follow the^lf, or may one or more of them be elimmated 
from consideiation at once? Since the U's m rows 13 and 14 fall outside the 4 consecutive rows 
above that in which the jrf is located, it follows that neither one of these U’s can be the one that 
^ succeeds the IS Thus two candidates arc automatically eliminated from consideration The U 
in row 17 and the U in low 20 are both possible candidates 

14 Solution of example —a With the foregoing preliminaries out of the way, the solution 
of the cryptogram can now be carried forward with rapid progress It has been mdicated that 
the Q m row 19, column 7 (fig 9), may be combined with either the U m row 17 column 1, or the 
U m row 20 column 6 Suppose the columns of figure 9 are now cut apart for ease m an agi ammmg 
Juxtaposmg the indicated columns yields what is shown in figure 10 Smee the combination 
shown at a m figuie 10 involves column 1, it obviously begins with the letter 0 and ends with the 
letter A or L, no other letters can be added to this column Since column 7 is alieady the maxi¬ 
mum length this column can be under any circumstances, no letters can be added to it at the 
bottom Theiefore, all the digraplis possible to foim by juxtaposing these two columns are 
indicated in figure 10a There are only 17 digraphs m all, whereas there should be at least 18 
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7 1 

7 « 

4 7 « 

1 

12 

4 

7 8 10 

U 

u b 

0 



a 

u b 

m 

m 1 

a u b 



a 

m 1 0 

e 

0 0 

ami 

0 

r 

c 

0 0 3 

t 

t H 

0 0 0 

D 

A 

T 

t H r 

Y 

Y B 

T t H 

N 

T 

R 

Y B A 

0 

0 V 

R Y B 

N 

S 

M 

0 V I 

I 0 

I T 

MOV 

P 

0 

S 

I T I 

K D 

K B 

SIT 

T 

A 

C 

K B E 

N N 

N E 

C K B 

I 

L 

L 

N E A 

K N 

K S 

L N E 

R 

0 

C 

K S T 

T P 

T R 

C K S 

N 

D 

S 

T R E 

N T 

N S 

S T R 

T 

I 

0 

N S E 

D I 

D Y 

0 N S 

D 

R 

E 

D Y A 

A R 

A L 

E D Y 

T 

0 

F 

ALL 

H N 

H X 

F A L 

U 

R 

C 

H X A 

I T 

I R 

C H X 

R 

Y 

F 

IRE 

R D 

R 0 

FIR 

0 

N 

F 

RON 

H T 

H R 

FRO 

E 

N 

T 

H R E 

Q U 

Q u 

T H R 

X 

R 

E 

Q U E 

I R 

I M 

E a U 

A 

G 

E 

I M M 

E 0 

E E 

E I M 

L 

Y 

E 

E E Y 

T E 

T T 

E E E 




T T T 

E X 

E 

T T 




E 

A 


E 





L 







a 

~T 

c 




d 


FlQtlEB 10 

Hence, combmation 7—1 is impossible, and combmation 7—6 is the only one that needs to be 
considered further There are many excellent digraphs m it, and only one which admittedly 
looks rather bad, the H X Seeing the digraphs K B and K S m these columns, a good assumption 
to make is that the K’s are preceded by the letter C Is there a column with 2 C’s m approxnnately 
the coriect region? Column 4 meets this requirement Note the excellent tngraphs it yields, 
as shown m figure 10c It now becomes fairly easy to add columns to this nucleus For mstance, 
thetngraphR Y B suggests a word endmg m R Y, such as INFANTRY, ARTILLERY, CAVALRY, 
thetrigraphM 0 V suggest MOVING, the tngraph C K B suggests the word ATTACK, followed by 
a word begmnmg with B, and so on Trial of only a few columns soon yields what is showm m 
figure lOd, from which it soon becomes probable that the long columns end with column 12, smee 
the letters after L Y yield an impossible sequence (E E E Y) Smee it was origmally assumed 
that theie are only 4 short columns m the transposition rectangle, and smee 4 columns have 
already been placed at the right (4-7-6-10), the rectangle, with the columns thus far placed, 
must be as shown m figure 10c This, then, at once tells what the limits of columns 2,3, 5, 8,9, 
and 11 must be, and the rectangle can now be filled m without further delay The completed 
rectangle is shown m figure 11 
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1 12 4 7 « 10 



8 2 S 3 11 9 1 12 4 7 6 10 


1 

E 

N 

E 

M 

Y 

F 

0 

R 

C 

E 

E 

S 

2 

T 

I 

M 

A 

T 

E 

D 

A 

T 

T 

H 

R 

3 

E 

E 

I 

N 

F 

A 

N 

T 

R 

Y 

B 

A 

4 

T 

T 

A 

L 

I 

0 

N 

S 

M 

0 

V 

I 

5 

N 

G 

I 

N 

T 

0 

P 

0 

S 

I 

T 

I 

6 

0 

N 

T 

0 

A 

T 

T 

A 

C 

K 

B 

E 

7 

T 

W 

E 

E 

N 

H 

I 

L 

L 

N 

E 

A 

8 

R 

T 

A 

B 

L 

E 

R 

0 

C 

K 

S 

T 

9 

A 

T 

I 

0 

N 

A 

N 

D 

S 

T 

R 

E 

10 

A 

M 

J 

U 

N 

C 

T 

I 

0 

N 

S 

E 

11 

V 

E 

N 

H 

U 

N 

D 

R 

E 

D 

Y 

A 

12 

R 

D 

S 

E 

A 

S 

T 

0 

F 

A 

L 

L 

13 

I 

S 

0 

N 

C 

H 

U 

R 

C 

H 

X 

A 

14 

R 

T 

I 

L 

L 

E 

R 

Y 

F 

I 

R 

E 

15 

S 

E 

V 

E 

R 

E 

0 

N 

' F 

R 

0 

N 

16 

T 

0 

F 

S 

E 

V 

E 

N 

T 

H 

R 

E 

17 

G 

I 

M 

E 

N 

T 

X 

R 

E 

¥ 

U 

E 

18 

S 

T 

B 

A 

R 

R 

A 

¥ 

E 

I 

M 

M 

19 

E 

D 

I 

A 

T 

E 

L 

Y 
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b The last step, recovering the literal key, is then taken The key is to be found among 
the letters of the hteral key reconstruction diagram m figure 12 



Fiquei: IZ 


The termmation ATIONS seems a lilcely possibdity If this is correct, assignment of letters 
becomes modified as shown m figure 13 



Fioueb 13 


The word PENETRATIONS will fit and it is taken to be presumably correct There is no absolute 
certamty about the matter, for it is conceivable and possible that there are other words which 
can be made to fit the sequence of key numbers given 

15 Alternative method of solution —a The foregoing solution will no doubt appeal to the 
student as bemg straightforward and simple— rf the original assumption as to the width of the 
transposition rectangle is correct But, unfortunately, there is no way of knowmg whether such 
an origmal assumption is correct untd solution is weU under way In practice, of course, what 
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might be done within a well-organized cryptanalytic unit would bo to divide up the work among 
the mdividuals eonstitutmg the unit, each bemg assigned one or more specific hypotheses to try 
out with respect to width of rectangle Then one of these mdividuals would ^d the correct 
width and he would be joined by the others as soon as an entering wedge had been found in this 
way Of, if the ciyptanalyst is workmg alone, he must try out successive hypotheses as to 
width of rectangle untU he hits upon the correct one In making these hypotheses he must be 
guided by previous experience with enemy correspondence, which may affoid clues as to mmimum 
and maximum widths of rc( tangles 

b Howevoi, there is another method of attack which does not necessitate makmg any 
definite initial assumptions with respect to the width of the transposition rectangle This method 
IS a modification of the method sit foith in the picccding paiagiaph The text of the crypto¬ 
gram is written out columnwise on cross-section papei, eveiy fifth letter being numbered for pur¬ 
poses of refeience Plenty of space is left between the columns, and about 10 oi 15 letters at the 
bottom of each colunm are repeated at the top of the next column so that at any point m the 
tianscription there will be in a single unbioken string at least one complete column of letters from 
the transposition rectangle Then a section of consecutive letteis of text is written on a separate 
strip of cross-section paper, columnwise of course, and by juxtaposmg this strip against the whole 
text, slidmg it to vanous points of tomcidcncc against the text, an attempt is made to find that 
position m which the best digiaphs aie foimed of the letteis on the movable stiip and the fixed 
sequence Of course, if there is a Q m the cryptogram, the slidmg-stnp section is made to contam 
this letter, and the strip is then placed agamst the text where a U is found, so as to form the digraph 
QU The digraphs foimed above and below the QU aie then studied, possibly a written record is 
made of the digiaphs found Then the same tlimg is done with the Q and all othei U’s m the 
text, to insuic that a correct stait is made It is this mitial step which is hkely to give the most 
difficulty (if there is anything difficult at all in the piocedure) and it is important that it be cor¬ 
rect If this fust step IS easy, then solution follows quite rapidly, if the cryptanalyst is unlucky 
and makes seveial false starts, the process is likely to be a slow one In choosing from among 
several possible juxtapositions it may be advisable to calculate the probability value of each 
possibility by adding the logarithms of the frequency values of the digraphs, as explamed m 
paragraph 7q In the absence of any Q’s m the text, recourse must be had to the formation of 
other probable digraphs, based upon the presence of certain other telltale low-frequency letters, 
such as C, H, J, K, V, and X The cryptanalyst is fortunate if there are two or three of these low- 
frequency letters close to one another m a senes of letters, for m this case he can search lor a 
place where there are high-frequency letters (m a correspondmg sequence) that might be com- 
bmed with them For example, suppose that a text shows a sequence V E H H K 

A sequence such as A R T C C would be excellent to try, for it will yield the digiahhs 

AV, RE, TH, CH, CK Or if there is a long sequence of consonants, the cryptanalyst should 
look for a coirespondmgly long sequence of vowels, smeo these make the best combmations and 
are therefoic most probable For these reasons it pays to study the text quite carefully befoie 
choosing a starting pomt, to find all such peculiar sequences as might be useful m allordmg a 
good pomt of departure It should also be noted that there are at least two correct positions at 
which the slidmg stnp can be j,uxtaposed against the text, since m the cnciphermg rectangle the 
letters m one column form digraphs with the letters m the column not only on the right but also 
on the left In the abscni c of any Q’s, or other low-frequency letters suitable for a pomt of depar¬ 
ture, the very fust 20 or 25 letters of the cryptogram may be used as the startmg pomt, smee 
these letters come from column 1 of the transposition rectangle and therefore there is no uncer- 
tamty at least as to the letter which is at the top of that column, or, the last 20 or 25 letters of 
the cryptogram may be used as the staitmg pomt, smee these letters come from the last-num¬ 


bered colunm of the rectangle and therefore there is no uncertamty at least as to the letter which 
18 at the bottom of that column 

e Suppose that a good initial juxtaposition has been found for the portion of the text that 
has been wmtten on the slidmg stnp, and that a senes of excellent digraphs has been brought to 
hght The next step is, of couise, to add to these digraphs on either 
side by finding sections of text that will yield “good” tiigiaplis and 
tetragraphs Foi example, suppose that the initial juxtaposition has 
yielded what is shown m figuie 14 Tlu* digiapli P R suggists that it ^ ^ R R S 

must be followed by a ^o^\cl, prtfciably E, A, ot 0, the digi.iph A V ^ ^ NAT 

might be pait of the woid CAVALRY, in which case it will be followed ^ ^ P R E 

by A, the disiaph C R suggests that it might be followed by the vowel ® TOR 

A or E A place is therefore sought, m the icst of the text, wlieie ^ ^ A V A 

there is a sequence of the letteis heic desiieil, and, of course, at the ^ ^ RED 

proper intefholb Suppose such a sequence is found and j’lelds what is ^ T H R 

shown! m figuic 15 The skeletons of woids arc now beginning to ^ ^ C H U 

appeal Assuming that A V A is indeed part of the woid CAVALRY, ^ ^ C K A 

theie should be an L to follow it, the tngiaph TIN suggests the ter- ^ ^ ILL 

mmation G, the tiigiaph Z E R suggests the woul ZERO A section of ^ TIN 

text IS theiefoie sought, which will have the letteis L, G, and 0 iii the ^ ^ C R A 


order L GO Enough has been shown to demonstrate ^ K 

the proceduie In the couise of the woik it soon becomes evident ^ ^ E A 0 

wheie the ends of columns are, because tin* digiaphs above and below 

the nuclear oi “good” portion become “bad” quite suddenly, just as ,4 figcee is 

soon as letters belonging to nonadjaceiit columns m the oiigmal rec¬ 
tangle aie brought together For example, m figure 15 it is observed that the tngraph at the 
top, R R S, IS highly impiobable, as is likewise the tngraph at the bottom, E A 0 This suggests 
that these letters have been brought together erroneously, that is, that they do not belong in 
adjacent columns in the enciphermg rectangle If this is true then the “good” portion is com¬ 
posed of the 13 letteis between these two extremities and therefore the columns are about 13 
letters long Additional woik will soon show exactly how long each column really is, and when 
this has been ascertained the problem has been piactically completed, since at the same time 
that this becomes evident the sequence of columns has also become evident 

d An example of solution by this alternative method may be helpful Using the ciypto- 
giam of paragraph 13 as an example, figuie 16 show s how the text might be transcribed on a sheet 
of cross-section paper Noting that the message contains a Q as the 129th letter, a section of 
text to mclude the Q is transcribed on a strip of cross-section paper and this stnp is then juxta¬ 
posed against the remaining text to brmg the Q in fiont of a U How many letteis should bo 
mcluded m this strip? The message contains 224 letters, if a width of say 10 to 20 columns is 
assumed, the columns of the rci tangle will be about 12 to 22 letters m length It will be safer to 
assume a convenient length closer to the maximum than to tlie minimum, consequently a length 
of 20 letters will be tentatively assumed Now the Q may be at the top of a column, at the middle 
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130 lA 

EO 16 

EE 60 

EE 

EC 

TE 

TN 

TT 

TL 200 

EX 

EL 

EY 116 

ER 

TA 

TE 

TO 

TE 

136 NL 

136 NS 

136 NI 

136 NN 

ON 20 

OE 36 

OK 

OR 

TI 

TA 

TN 

TT 205 

re; 

RA 

RK 120 

RR 

AT 

AC 

AT 

AA 

140 AG 

140 at 

140 an 

140 at 

VN 25 

VR 60 

VD 

VS 

RW 

RM 

RA 

RO 210 

IT 

IS 

IH 126 

lA 

RT 

RC 

RI 

RL 

i« SM 

146 SL 

i« SR 

146 SO 

TE 8° 

TC 66 

TH 

TD 

GD 

GS 

GQ 

GI 216 

SS 

SO 

SI 130 

SR 

ET 

EE 

ET 

EO 

1 

2 

3 

4 
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Or at the bottom—there is no way of telling at this point Hence, to make sure that nothing 
IS overlooked, suppose a section of 41 letters is taken, with the Q at the center There are 4 U’s 
in the message, and 4 trials are to be made The results are as mdicated in figure 17-A Examm- 
ing combination 1 in figure 17-A, the digraphs formed both above and below the Q U are not at all 
bad In fact, not one of those above the Q U is impossible and the same 
IS true of those below the Q U until the digraph V N is reached Hence, 
combination 1 is possible As foi combination 2, this at once appears 
AMT Digiaphs such as I I, and I H aie highly improbable, and 

this combination may be discarded with safety Combination i is 
possible from the top digraph, 0 F, to the 12th digraph below the Q U, 
although the digiaph H X looks very bad However, the X might be a 
^ sentence separator, so that this combination cannot be discarded 

SIO SIT Combination 4 looks very improbable, with the digraph H N occurrmg 

CKD CKB equally bad digraphs showing Of the foui possibil- 

LNN LNE 2 and 4 are discarded, leavmg 1 and 3 for 

CKN CKS fuithei study It is \ciy difficult to choose between these two possi- 

STP STR All the digraphs in combination 1 down to digraph V N are 

ONT ONS possible, many of them are excellent As for combination 3, all the 

EDI EDY flipraphs down to V D arc also possible and many of them aie excellent 

FAR FAL There does not seem to be much use to add the frccjuency values of the 

CHN CHX digraphs (or logaiithms thereof) m each combination because it is hard 

FIT FIR ^ digraphs to begin or end, although as a last resort 

FRD FRO could of course be done However, perhaps it is not essential that 

THT THR * choice be made at once, possibly further work along jfAe lines now to 

poii pnii demonstrated wiU show v'hich combination is correct 

EIR EIM Noting the 2 K’s (m the digraphs K B and K S) among SOFV 

FPn FFF combinations before the Q, assume that these K’s are ERMT 

MTE MTT digiaph C K Is theie a sequence C Cm AUBR 

lEX lEY the text’ There is but one such place, at the 63d letter AMIE 

AT A ATn Suppose the coriespondmg section is placed in front of GEES 

INL INI combinations 1 and 3 of figure 17, as shown in figure TTHR 

TON TOK immediately becomes evident that combma- RYBA 

ETI ETN ^ correct one, for note the excellent tn- MOVI 

ARE ARK graphs it gives, as compaied with those in combination SITI 

lAT lAT ^ second trigraph below the E Q U CKBE 

JAG JAN combination 3 consists of 3 E’s, indicating that the LNEA 

end of the columns has been reached ]ust before this CKST 
riQUE«i 7 -B trigraph As foi the top trigraphs of figure 17-B they STRE 

are good all the way up But now the skeletons of ONSE 

words aie beginning to appear The THR immediately above the E Q U sug- EDYA 

gests eitlier THREE or THROUGH, the F R 0 above the THR suggests FROM or FALL 

FRONT Suppose the word REQUEST is assumed foi the E Q U, and the word CHXA 

THREE is assumed for the THR above it This requires a section with 2 E’s m FIRE 

succession prom 


e There are several such places m the text, and further Innitation is advisable THRE 

The 8th trigraph from the top is certainly suggestive of the word MOVING, which EQUE 4- 

requires an I to follow the V Is there a place m the text where an I occurs 12 EIMM 

letters before a succession of two E’s’ There is one such place, and the corres- EEEY 
ponding section is juxtaposed at the proper place, yielding what is shown m 
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figure 17-C The upper and lower limits of the col umn s are now fairly definite and are 
marked by the horizontal bars, tetragraphs E E E Y at the bottom and A M I E at the top 
are very improbable The [tetragraph C E E S below the top bar is possible, because it may 
represent the end of a word like FORCE followed by the beg inning of the word ESTIMATED, the 
tetragrapli above the bottom bar suggests a word ending m E followed by the word IMMEDIATE 
It seems hardly necessary to contmue with the demonstration, m a few moments the entire 
diagram is leconstructed and yields the solution Durmg this process as soon as a section of 
text in figure 16 has been used it is crossed off, so as to prevent its letters from bemg considered 
as further possibilities for addition to the reconstruction diagram Thus, as the work progresses 
the number of available sections becomes progressively less, and the choice for successive sections 
for addition to the diagram becomes a quite easy matter 

/ When two or three operators are assigned to work upon a cryptogram by this method, 
solution can be reached m a very short space of time, especially if each one of the operators takes a 
different pomt of attack After a few mmutes the fragments of texts obtained may be assim¬ 
ilated mto one message which is then completed very speedily 

g This and the next four subparagraphs will be devoted to some remarks of a general natui e 
concerning columnar transposition of the foregoing type The degree of cryptographic security 
afforded by simple columnar transposition methods, especially when mcompletely-filled ma¬ 
trices are employed, is considerably mcreased if some of the cells of the matrix are occupied by 
nulls instead of significant letters If nulls are employed judiciously their presence serves to 
confuse the cryptanalyst by mtroducmg unusual digraphs, tngraphs, and polygraphs which 
may lead him to discard correct combmations of columns in the anagrammmg process and thus 
retard solution Obviously, the use of low-frcquency letters such as J, Q, X, or Z as nulls does 
not commend itself for this purpose, as such letters would not only distort the normal frequency 
distribution and thus give clues to the presence of nulls, but also they would be quickly 
“spotted” m the anagrammmg process 

h Another subterfuge, and a good one, to put stumbling blocks m the way of a quick 
solution IS to leave “blanks” withm the transposition matrix, that is, certam cells are left un¬ 
occupied by letters of the text If only a few cells distributed irregularly within the columns 
of the transposition matrix are designated as blanks, the disturbing effect upon the anagram¬ 
mmg process is quite marked This more or less effectively hmders the cryptanalyst m his 
attempts to ascertain the lengths of the columns and considerably increases the difficulty of 
the anagiammmg process 

i In order to fix definitely the positions of the nulls or of the blanks m the transposition 
matrix, defimte prearrangements between correspondents are necessary These may be in the 
nature of “forms” outhnmg the matrix, showing the number of columns and the positions of the 
cells to be occupied by nulls, or of the cells to be left vacant in the mscnption process, or the 
positions of these cells may be denved from the elements of the transposition key itself If 
“forms” are employed, they may be used with varying transposition keys, so that even though 
there may be only relatively few different forms, the use of varying transposition keys serves to 
mcrcase cryptographic security to a rather marked degree 

j If nulb, or blanks, or both, are distributed irregularly but symmetrically throughout the 
transposition matrix (as, for example, blanks are distnbuted in cross-word puzzles) solution 
of sii^le messages produced by sunple keyed-columnar transposition from such a matiix 
becomes an extremely difficult if not impossible problem Naturally, if nulls and blanks are 
distributed irregularly and assymmetneaUy the matter becomes hopeless, as far as a single 
message is concerned 

k Of course, if several messages of identical length and m the same key are available for 
supenmposition, the presence of the nulls or blanks then makes little difference, because the 







general solution to be explained m a subsequent paragraph (par 26) can be applied Or if mes¬ 
sages with similar begmnmgs or similar endmgs are available, solution is facilitated here as m the 
simpler case where nulls or blanks are not employed, as will be explained m subsequent para¬ 
graphs (pars 23-24) Considerations of space prevent gomg mto detail m the solution of an 
example, and the student should undertake a study of these cases for himself 

16 The C^P and the P-»C sequences — a Two numencal sequences which constitute the 
bases for several very important ciyptanalytic operations and procedures m the solution of 
transposition ciphers may be denved from, and are applicable to, most ciphers of this class They 
are as follows 

(1) A sequence the successive terms of which mdicate the position numbers that the 
successive letters of the plam text occupy in the cipher text This sequence will hereinafter be 
designated the plairir^cipher sequence, or F->C sequence 

(2) A sequence the successive terms of which indicate the position numbers that the 
successive letters of the cipher text occupy m the plam text This sequence will heremafter be 
designated the cipher-^plain sequence, or C-^P sequence 

b These two sequences are obviously related, one being the ini erse or indexed version of the 
other Given one of the sequences, the other can be derived from it by the simple operation of 
indexing, m a normal sequence, the positions occupied by the numbers constituting the sequence 
on hand An example will be given presently 

c Note the encipherment shown in Figure 18-A 

TRANSPOSITION 

12 9 1 4 10 8 6 11 2 13 3 7 5 

THEQUICKBROWN 

FOXJUMPSOVERT 

HELAZYDOG 

Term No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 18 18 17 18 19 20 21 22 23 24 28 26 27 28 20 30 31 32 33 34 36 

Cipher EXLBOGOEQJANTCPDWRIMYHOEUUZKSOTFHRV 

FiouM 18-A 

Now, if, mstead of letters, the successive numbers 1, 2, 3, are inscribed m the cells of the 
matrix, m normal order of writir^, the “cipher text” becomes the P-»C sequence and is as 
follows 

12 9 1 4 10 8 6 11 2 13 3 7 5 

01 02 03 04 05 06 07 08 09 10 11 12 13 

14 15 16 17 18 19 20 21 22 23 24 25 26 

27 28 29 30 31 32 33 34 35 

Term number. . . 1 2 3 4 8 6 7 8 9 10 11 12 13 14 16 16 17 18 19 20 

P->C equences. 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 

21 22 23 24 28 36 27 28 29 30 31 32 33 34 36 

32 02 15 28 06 18 31 08 21 34 01 14 27 10 23 

Fioubi 18-B 

The student may easily verify that the P^C sequence is what it purports to be by notmg that, 
accordmg to it, the 1st letter of the plam text of the illustrative message, Tp, becomes the 31st 
letter of the cipher text (since the number 01 occupies position 31 m the P->C sequence shown 
above), and that m the cryptogram the 31st letter is To, the 2d letter of the plam text, Hp, becomes 
the 22d letter of the cipher text and that m the cryptogram the 22d letter is Hg, and so on In 
connection with the P->C sequence, it is to be noted that successive terms m the sequence, 
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m the case of single transposition, show a constant difference except when passing from a greater 
to a smaller number, which happens every tune a transition is made from a term applymg to 
the bottom element of one column to a term applymg to the top element of the next column 
For example, m the case of the 1st three terms m the sequence 16—03=13, 29—16=13 
However, in the case of the 3d term of the sequence (29) and the 4th (09) the passage is from 
a greater to a smaller number and the constant difference, 13, no longer is evident The cause of 
the constant difference is, of course, obvious and follows directly from the mechanics of tbe trans¬ 
position system itself The pomt to be specially noted is that the existence of such a constant 
difference (with the exceptions noted above) may be taken as one of the identifymg characteristics 
of smgle columnar transposition, double columnar transposition or other types of complex trans¬ 
position will show no such constant difference throughout the P-»C sequence 

d Given the P->C sequence m subparagraph c, its mverse, the C->P sequence is established 
merely by preparing an indexed version of the former Thus 


Term number.. 01 02 03 04 08 06 07 08 09 10 11 12 13 14 16 16 17 18 19 20 

P-»C sequence_ 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 

21 222324 25 2627282930 31 32 333438 

32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 

Term T.nmiw.r „ ... 01 02 03 04 06 06 07 08 09 10 11 12 IS 14 18 16 17 18 19 20 

C->P sequence_ 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 

21 22 23 24 28 26 27 28 29 30 31 32 33 34 35 

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 


e The C->P sequence can also be pioduced m another way Suppose that numbers are 
inscribed m the cells of the transposition matrix, not m the normal manner of writing from left to 
ri gh t and form the top downward, but accordmg to the route followed m transcribing the numbers 
to form the “cipher text,” that is, m key-number order m the columns of the matrix Thus 
12 9 1 4 10 8 6 11 2 13 3 7 5 

31 22 01 09 25 19 14 28 04 34 07 17 12 

32 23 02 10 26 20 15 29 05 35 08 18 13 

33 24 03 11 27 21 16 30 06 

Fioubi 18-C 

If these numbers are now transcribed accordmg to the normal manner of writing (from left to 
right and from the top downward), the sequence produced is 31 22 01 09 25 , which com- 

cides with the C-»P sequence shown m subparagraph d above, which m turn was derived from the 


P->C sequence 

Term number 01 02 03 04 05 06 07 08 09 10 11 12 IS 14 15 16 17 18 19 30 

C->P sequence_ 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 16 


21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 
j The C-»P sequence may also be called the anagram sequence because it can be established 
as a r*ult of a solution accomplished by anagrammmg superunposed messages of identical length 
It IS clear that what is accomplished m such a solution is to rearrange the letters of the cipher 
text to bring them back into their ongmal order m the cipher text, that is, the solution involves a 
C->P conversion 

g The P-»C sequence is called by a recent French author the sp sequence (from the Greek 
word kryptos) because it gives the order of the plam-text le'tters as they occur m the cryptogram 
The P-jb sequence is also termed the encipher sequence by another writer, and still another has 
called it the transposiiion sequence The present author believes that the termmology adopted 
herem, m, P->C sequence and C->P sequence, is less confusmg and serves more accurately to 
identify or characterize these sequences than the other designations herem mdicated 
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h The Urm number is useful merely to facilitate findmg and referrmg to specific terms or 
numbers m a sequence, whether the latter be a C-»P or a P^C sequence The number simply 
mdicates the locus or position a term occupies m the sequence In connection with a plam- 
text message the consecutive term numbers 1, 2, 3, may be used as loci for the successive 
letters of the message, m coimection with a cryptogram the consecutive term numbeis 1, 2, 3, 
may bo used as loci for the successive lotteis of the cipher text 

% In single, keyed-columnar transposition an interesting relationship exists between sections 
of the C->P sequence Consider the C-^P sequence given in subparagraph d above, and note 
that by adding the integer 1 to the successive numbers thereof, sections of the ongmal sequence 
show certain identities with sections in C-»P sequence +1 Thus 

Term number... ... 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 30 21 22 

C^P sequence. 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 Ifi 29 05 

C^P sequence-1-1... 32 23 02 10 26 20 15 29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 

23 24 25 26 27 28 29 30 31 32 33 34 35 

35 08 18 13 33 24 03 11 27 21 16 30 06 

36 09 19 14 34 25 04 12 28 22 17 31 07 

In fact, if the successive numbers of the C^P sequence are set down in rows to produce sequent 
numbers in columns, the following mteresting diagram is obtained 

31 22 01 09 25 19 14 28 04 34 07 17 12 

-1-1 32 23 02 10 26 20 15 29 05 35 08 18 13 

-1-1 33 24 03 11 27 21 16 30 06 

Figubx 18-D 

Reference to figure 18-C will show the identity of this diagram with that figure Such an 
arrangement of course mdicates at once the number of columns m the transposition rectangle, 
from which it follows that if the C-»P sequence is available it is an easy matter to establish the 
outlines of the transposition matnx The phenomena dealt with in this subparagraph are but 
a reflection of those discussed in subparagraph c above 

j The phenomena ]ust mdicated may, however, be employed to advantage m another 
manner m the solution of an unknown example Referring to the illustrative ciyptogram m 
subparagraph c above, suppose that the cryptanalyst has reason to suspect the presence of the 
probable word QUICK The letters necessary to produce this word (and their term numbers m 
the cryptogram) are as follows 

25 

9 26 19 H 28 

QUICK 

The sequence 9-25-19-14-28 now constitutes a portion of the C->P sequence Adding the 

mteger 1 successively to these C->P numbers, let the coi responding letters be set down along¬ 
side the numbers Thus 


Base. 9 2g 19 14 28 = Q U I C K 


Derivative 1_ 

. 10 

26 

27 

20 

15 

29 

= J 

U 

Z 

« 

P 

S 

Derivative 2_ 

. 11 

27 

28 

21 

16 

30 

= A 

Z 

K 

Y 

D 

0 

Denvative 3_ 

. 12 

28 

29 

22 

17 

31 

= N 

K 

S 

H 

W 

T 
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Here it will be seen that portions of “good” plain text become manifest, viz, JUMPS and AZYDO 
The 3d denvative no longer is “good” because the rectangle has but 3 rows and consequently 
only the Ist and 2d derivatives from the “base” are valid It is obvious that the foregoing 
method of deriving plam-text sections from a correct probable word offers considerable possi- 
bihties as a cryptanalytic tool, especially in the case of matrices with more than 2 or 3 rows If 
sections of text can be reconstructed m this manner and then combined in jiroper sequence the 
reconstruction of the complete matrix and the transposition key is a relatively simple matter 
The application of the foregoing principle to the solution of unknown examples is, of course, 
obvious 

k There is also an mterestmg relationship between the sections of the P->C sequence for a 
ciyptogram, though it is somewhat different from that discussed is subparagraphs ^ and / m the 
case of the C-»P sequence Consider the P->C sequence set forth in subparagraph d above and 
note how, by adding the mteger 1 to the successive numbers, sections of the P-»C sequence become 
identical with sections of the P->C-l-l sequence Thus 

P-»C sequence_ 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 

-i-2-3-4-S-6-7— 

06 19 32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 

-8-S-io-n- “12- u— 


P-»C sequence-1-1_ 04 17 30 10 23 36 12 25 05 18 31 14 27 08 21 34 13 26 07 

-i=5— -1!^ “3^7-l=io--6=Ti-7=3 

20 33 03 16 29 06 19 32 09 22 35 02 15 28 11 24 

“8=6-9=T-io=8- 17=2 -73=3-i3=r- 

The equivalencies between identities, as indicated above, indicate not only that the enciphering 
matrix has 13 columns, but also they may be used to establish the actual transposition key or 
at least a cychc permutation of the key, by constiucting a chain of equivalents Thus 

1=4, 4=10, 10=8, 8=6, 6=11, 11 = 2, 2=13, 13=3, 3=7, 7=5, 5=12, 12=9, 9=1 
This yields, by elimmatmg the term common to successive equivalents, the following chain or 
transposition key 

1 4 10 8 6 11 2 13 3 7 5 12 9 

Reference to figure 18-A will show that the foregoing key is a cyclic permutation of the actual key 

I There remam only some mmor remarks which, bemg of a general nature ansing from the 
mechanics of simple keyed-columnar transposition, are worth notmg They are discussed in the 
subsequent two subparagraphs 

m An appreciation of the difficulties introduced by employmg only incompletely-filled 
rectangles mdicates that it would be very useful if there were some method whereby m the initial 
stages of solution the cipher text could be divided up correctly into its component long and short 
columns, for the subsequent steps of rearranging the columns by the anagrammmg prmciple are 
quite simple If, for example, there were some feature which provided a means of ascertaining 
when m encipherment a transit was made from the bottom of one column to the top of the next 
column, then the location of these transition points or “breaks” would obviously permit of break- 
mg up the cipher text into its correct long and short columns In later studies cases of this kind 
Will be encountered 

n It IS useful sometimes to be able to ascertain just where breaks cannot occur, that is, 
where a passage from the bottom of one column to the top of the next one cannot occur m the 
cipher text, for this will limi t the field for experiment A consideration of the mechanics of the 
system will afford an excellent clue to the fact that this determmation is easy to make In any 
transposition rectangle mvolvmg simple keyed-columnar transposition the mterval, m the cipher 
text, between two consecutive letters which are in the same row in the matrix is the sum of a 
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multiple of the length of the short columns and a multiple of the length of the long columns Foi 
example, consider the ad] acent letters C K in the plam-text rectangle in figure 18-A In the cipher, 
Cc IS the 14th letter, K, is the 28th and the interval is 28—14=14 The message has a total of 
35 letters and the matrix has 13 columns, 9 long ones of 3 letters and 4 short ones of 2 letters 
An interval of 14 can therefore be brought about m only one way (4X3) + (1X2)=14, which 
means that 4 long columns and 1 short one mtervene between the C and the K m the plam text, 
and that the key numbers applicable to the two columns are 5 apart in sequence, that is, if the 
column m which C is located has key number 1, the column next to it on the right is 6, or if the 
former is 2 the latter is 7, and so on Refeience to figure 18-A will show that these deductions 
are correct and that the key numbers mvolved are 6-11 Howeve^, a more general treatment is 
possible Given a cryptogram of 26 letters and an assumea 
width of 6 columns, for example, the matrix can have only 2 
columns of 5 letters and 4 columns of 4 letters Settmg down 
the multiples of the two lengths m tabular foim, for conven¬ 
ience, the followmg is obtamed 

5 4 

0 multiple... 0 0 

1st multiple. . 5 4 

2d multiple_ 10 8 

3d multiple—.. — 12 

4th multiple... — 16 

All the possible positions of breaks m the cipher text, that is, tiansits from the bottom of one 
column to the top of the next column, may now readily bo ascertained by findmg the totals result- 
mg from making all the possible combmations of the mdicated multiples taken in pairs It is 
convenient to draw up a table to show directly the sums of the combinations Thus 




If, now, diagonal Imes are diawn from the lower left-hand comer to the upper right-hand comer 
of the diagram, the locations of all possible breaks are given Thus, there can be a break be¬ 
tween the 4th and 5th letters (passing fiom a short column to the next column, which may be 
long or short, of course), there cannot be a break between the 5th and 6th letters, nor between 
the 6th and 7th, nor between the 7th and 8th, there can be a break between the 8th and 9th, as 
well as between the 9th and 10th, but not between the 10th and 11th, and so on Suppose that 
for one reason or another the cryptanalyst has good reason to suspect that a break occurs imme¬ 
diately after the 13th lettei This means that there are 2 short columns (of 4 letters) and 1 long 
column (of 5 letters) up to that break The diagram shows that there remam only 2 short 
columns and 1 long one, and the only breaks that are possible beyond the one at the 13th letter 
are Between the 17th and 18th, or between the 21st and 22d letters 
0 The importance of the various prmciples set forth m this paragraph will become evident as 
the student progresses m his studies of transposition ciphers 


Skction IV 


OPPORTUNITIES AFFORDED BY STUDYING ERRORS AND BLUNDERS MADE BY 
ENEMY CRYPTOGRAPHERS 

PBragrapb 

Importance of the study of errors and blunders m early work upon an unknown sy stem . 17 

Significance of terms “special solution” and "general solution” . - - . 18 

Examples to be studied. - - - - . 19 

17 Importance of the study of errors and blunders in early work upon an unknown 
system —a Blunders and mistakes made by cryptographic clerks in the execution of cryp¬ 
tographic clerks m the execution of cryptographic mstructions should be rare m a wcll-tramed and 
well-disciplmed cryptographic service Nevertheless, blunders and mistakes are committed 
despite all that can be done to prevent their occurrence Especially m the excitement prior to 
or during an important action or movement do such mstances take place and these afford golden 
opportunities for the enemy cryptanalytic service This situation exists m respect to all types of 
cryptograpluc systems and no cryptanalytic mstruction would be complete if cognizance were not 
taken of the advantages which may be leaped from the blunders, the mistakes, and, occasionally, 
the downright meptitude of the adversary’s cryptographers 

b Practically every cryptographic system affords opportunities foi the commission of errors 
m its application, and eaeh system more or less presents a separate case That is, the enors which 
may be made m one type of cryptographic system may be peculiar to that type alone and to no 
other type, hence, the astute cryptanalyst is constantly on the lookout for instances of crypto¬ 
grams contammg the specific type of error by which that system is handicapped Furthermore, 
the general types of blunders or errors that may be committed are nearly as numerous as are the 
general types of cryptographic systems, so that no complete list of such as may be encountered in 
practice can be drawn up 

c After the cryptanalyst has by pamstakmg and more or less arduous labors solved a system 
and has become thoroughly familiar with its mechanics, he should carefuUy review the details of 
the mechanics to learn what thing s can go wrong, what sorts of mistakes the enemy cryptographic 
personnel are likely to make, and then study the external manifestoMons of these aberrations so that he 
may be able to recognize instances of their occurrence in svhseguent cryptograms This sort of study 
has no value m itself particularly, its importance lies m the fact that the effects of erroneous 
treatment may lead to veiy rapid solution or to quick recovery of keys to subsequent messages 

d When an unknown system is under investigation and the cryptanalyst is strivmg to ascor- 
tam just how it operates (which is often the most difiicult step m solution), a study of the crypto¬ 
grams representing corrections to previous messages contammg errors is a most fruitful source of 
data Indeed, at tunes this sort of mtensive study will yield clues for solvmg a system which 
might otherwise resist all efforts to break it down for a very long time 

18 Significance of terms "special solution” and "general solution ”— a Now the importance 
of the comments made m the foregomg paragraph will be clear if it is noted that a study of the 
blunders and errors often leads to the elaboration of methods for the rapid breakmg down of 
cryptographic systems But it must also be realized that m some cases no blunders or errors are 
Bnnent.ial to a rapid solution of the type alluded to above Sometimes the very mechanics of 

( 37 ) 
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the system itself are such that unavoidable or unpredictable circumstances arise so that special 
solutions become possible The latter term calls for a bit of explanation 

h When the circumstances surrounding a specific cryptogram or set of cryptograms aie such 
as to present peculiar or unusual conditions that make a solution possible when m the absence of 
these conditions solution is either impossible or impiobable, the methods employed m reachmg a 
solution m such cases constitute what is commonly termed a special solution Some examples 
will bo demonstrated very soon Systems of which this may be true are, of course, cryptographi- 
(ally weak but it may be obseived that it is peihaps impossible to devise a system which may be 
consideied to be absolutely free from this souice of weakness 

c The advantages of a special solution for any type of cryptographic system are, as a rule, 
two in number First, it often makes a solution possible when otherwise this might not be the 
case Secondly, if often affords a method of achieving a very rapid solution m the case of a 
problem which otherwise might require a long time But a special solution presents one basic 
disadvantage It is by its very nature dependent upon the existence of unusual circumstances, m 
other words, upon chance or good foitune bringing about a set of circumstances favorable for a 
solution When these unusual conditions or circumstances do not obtain, then solution may be 
impossible Therefore, it is desirable to have, if possible, foi eveiy type of system a more or less 
general solution which may be applied m the absence of the unusual conditions necessaiy foi the 
application of a special solution In othei words, a general solution in ciyptanalysis implies a 
method or procedure which if applied in oidmaiy cases and under noimal conditions will yield 
the solution However, the term general solution m cryptanalysis must not be taken too literally 
The situation m cryptanalysis is not exactly analogous to that which obtains m the field of pure 
mathematics, for the circumstances are often quite different m the two sciences A general 
solution m mathematics is expected to, and will, solve every case that falls within its provmce, 
a general solution m cryptanalysis is likewise mtended to solve every case that falls withm its 
piovmce but this usually partakes more of the nature of a prayer or hope than an expectation 
Much depends upon the amount of traffic available for study, the length of mdividual crypto¬ 
grams, and the indefinable element called luck, that is, a set of fortuitous circumstances which 
happen to make a solution easy or diflScult, such as the presence of many or exceptionally long 
repetitions, etc Furthermore, whereas m mathematus a general solution prescribes the exact 
steps to be followed m amvmg at the solution and the latter can be applied m all mstances 
without variation or deviation from a fixed procedure, m cryptanalysis a general solution merely 
outlines a broad path that may be followed m order to arrive at a solution Application of a 
general solution m cryptanalysis m specific mstances may mvolve mmor detours to circumvent 
unexpected obstacles, or it may mvolve quite large changes or modifications m the general 
procedure 

19 Examples to be studied —a As stated above in paragraph 17, a complete hst of the 
specific blunders that cryptographic clerks are prone to perpetrate cannot be drawn up Ceitam 
of them may be described in general terms and examples given of some which have already been 
encountered m this and m precedmg texts Commonly it is the case that these blundeis do not 
become eyident until two or more cryptograms are available for companson One of the most 
frequent sources of circumstances leading to the transmission of cryptograms affordmg nch 
material for cryptanalytic companson is the following A ciyptographic cleik prepares a crypto¬ 
gram, m the course of which he makes a mistake of such a nature as to render the cryptogram 
difficult or impossible to decipher by the cryptographic clerk serving the addressee A request 
for repetition ensues, whereupon the enciphering clerk reexammes his onginal work and finds that 
he has made a mistake He then commits the grave blunder of reenciphermg the identical message 
(without paraphrasing) and transmittmg what to the enemy cryptanalysts is obviously a second 


l. 


version of the origmal message The consequences are often fatal to cryptographic security 
The least that can happen is that the key for this particular message may be disclosed very 
quickly, more serious, the basic or primary elements for the entire day’s traffic may be wrested 
from the blunder, but most senous are the consequences if it happens that the blunder has been 
committed immediately or soon after a new cryptographic system has been mstituted and the 
enemy cryptanalysts are exertmg strenuous efforts to learn its mechanics, for then is when the 
mformation to be gained is most valuable 

b In his previous studies the student has observed the many opportunities for quick 
cryptanalytic success afforded by enemy addiction to the use of stereotypic phraseology, espe¬ 
cially at the beginnings and endmgs of messages Stereotypic phraseology affords even more 
golden opportunities for cryptanalytic success m the case of transposition systems than it does 
in the case of substitution systemo 

c In the next few paragraphs some specific examples of the consequences of cryptographic 
blunders and meptitude m the case of transposition systems will be studied These are mtended 
to give the student some idea of the far-reachmg effects such studies may have It is important 
that he grasp the fundamental prmciples, for they will enable him to develop for himself the 
methods that he may find necessary m practical work Incidentally, it may be added that the 
student should not get the idea that these mstances are purely theoretical It is sometimes almost 
unbehevable that cryptographic clerks with any common sense would perpetrate the stupid 
blunders that they do occasionally commit 












Section V 

SPECIAL SOLUTIONS FOR TRANSPOSITION CIPHERS 


Paragraph 


Solution when the beginning or end of the plain text is known . . . .. .20 

The case of an omitted column . ..— - . - - 21 

The case of an interchanged pair of columns -. .- - - - 22 

Messages with similar beginnings .-. . -. - - 23 

Messages with similar endings ... . .24 

The solution of a single message containing a long repetition . . . „ . . 25 

Solution when several cryptograms of identical length and in the same key are available. 26 

Reconstruction of the keys in double transposition. — . 27 

Special cases of solution of double transposition ciphers.— . - - 28 


20 Solution when the beginning or end of the plain text is known —a It often happens, 
when correspondents have fallen into the bad habit of sending stereotyped communications, 
that the begmnmgs or the endmgs of messages become so fixed in then form and content that 
the enemy can with a fair degree of certamty guess what these will be m specific cases If so, 
a qmck solution can be reached, the key reconstructed for one message, and this will, of course, 
enable him to read all other messages m the same key This is particularly true of simple, 
keyed-columnai-tiansposition ciphers It is only necessary that the cryptanalyst cut the text 
up m such a manner as to brmg the letters composmg the assumed text all withm the same row 
or rows of the transposition rectangle 

b Suppose that the enemy frequently uses the mtroductory expression REFERRING TO YOUR 
NUMBER Here is a cryptogram assumed to begm with this phrase 


Cryptogram 


I M A 0 D 

R M 

G R N 

E R N 

I 

N 

T U S 

F S 

D R Y E P 

B R C 

F T 

0 I R N W 

T M 

0 I S 

0 I E 

G 

E 

D H 0 

P N 

C H L F U 

E S E 

P Q 

E R I A R 

U H 

I A G 

P A U 

0 

0 

S S S 

C I 

0 N R R E 

0 V 0 

E Y 

E M E V G 

T R 

I A F 

H T E 

P 

B 

N B T 

N E 

A E E T A 




c Assuimng that previous experience has mdicated that the enemy uses keys vaiymg 
from 10 to 20 letters m length, the arrangement of the letters m the tops of columns under a 
key length of 10 would be as shown m Fig 20 

123456789 10 

REFERRING! 

OYOURNUMBE 

R 

Fioube 20 

The first group of the cryptogram begms with I M The arrangement shown above gives I U 
as the top of a column, hence a key length of 10 is not coirect A key length of 11 is then tried 

123456789 10 11 

REFERRINGTO 

YOURNUMBER 

FiointE 21 
(40) 


Here a column is headed by I M, so that this is a possible arrangement If the width of the 
rectangle is 11, its outlmes are as shown m figure 22 There are 6 columns of 11 letters and 6 
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columns of 10 letters The text can now be marked oflE mto sections of proper lengths and, more¬ 
over, gmded by the letters which must be at the heads of columns, the text can be mscnbed m 
the rectangle m key order For example, column 1 must end with the second group, R M G R N, 
column 2 therefore begms with E R There is only one possibihty, viz, the fourth column 
This 18 a long column, and must therefore have 11 letters, makmg column 3 begm with R Y 
This defimtely fixes the position of the number 3 m the key, and so on The solution is reached 
aftei only a very few moments and is as shown m figure 23 
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» 

» 

8 

3 

« 

7 

1 

11 


10 

8 

R 

E 

F 

E 

R 

R 

I 

N 

G 

T 

0 

Y 

0 

U 

R 

N 

U 

M 

B 

E 

R 

s 

E 

V 

E 

N 

W 

H 

A 

T 

D 

I 

s 

P 

0 

S 

I 

T 

I 

0 

N 

H 

A 

s 

B 

E 

E 

N 

M 

A 

D 

E 

0 

F 

c 

R 

Y 

P 

T 

0 

G 

R 

A 

P 

H 

I 

C 

E 

Q 
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I 

P 

M 

E 

N 

T 

0 

F 

M 

E 

S 

s 

A 

G 

E 

C 

E 

N 

T 

E 

R 

F 

0 

U 

R 

T 

H 

P 

R 

0 

V 

I 

S 

I 

0 

N 

A 

L 

B 

R 

I 

G 

A 

D 

E 
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d The same general prmciples, modified to suit the circumstances, may be followed m the 
case mvolvmg known or suspected endings of messages The probable words are written out 
accordmg to various assumed key lengths and the superimposed letters fallmg at the bottoms 
of columns are sought m the cryptogram 

21 The case of an omitted column —a Sometimes a veiy careless clerk onuts a column m 
transcnbmg the text from the enciphermg rectangle and fails to check the number of letters m 
the final cryptogram Obviously such a cryptogram will be difficult if not impossible to decipher 
at the other end, and a repetition is requested and sent If now the identical plam text is en¬ 
ciphered correctly, two cryptograms are at hand for comparison This wnll disclose the length 
of one column, which can be assumed to be either a long one or a short one The position, m 
the correct cryptogram, of the column omitted from the mcorrect one ■wiU often afford direct 
clues as to the exact dimensions of the enciphermg rectangle For example, suppose the crypto¬ 
gram m paragraph 206 had first been transmitted as follows 


Cryptogram 


I M A 0 D 
I E G E D 
A U 0 0 S 
T E P B N 


R M G R N 
H 0 P N C 
S S C I 0 
B T N E A 


R Y E P B 
H L F U E 
N R R E 0 
E E T A 


R C F T 0 
S E P Q E 
V 0 E Y E 


I R N W T 
R I A R U 
M E V G T 


M 0 1 S 0 
H I A G P 
R I A F H 


6 The column which was omitted isERNINTUSFSD, and falls between columns 
1 and 3 Smce the omitted column con tarns 11 letters and column 1 con tarns 10, the dimensions 
of the rectangle immediately become known Thus, uncertamties as to the dimensions of the 


rectangle are dissolved and a large step forward has been made m the solution Also, the 
general whereabouts of columns 1 and 2 are now known, smce the former is a short one, the 
latter a long one 

22 The case of an interchanged pair of columns —a The keying element m the case of 
columnar transposition is sunply a practical means of controllmg the order m which the columns 
of the enciphermg rectangle are transcribed m formmg the ciphei text Commonly this numerical 
key 18 denved from a hteral key Suppose that a cryptographic clerk makes a mistake m the 
latter step For example, suppose that the hteral key is ADMIRATION and that as a result of a 
slight relaxation m attention he assigns the number 5 to the lettei N and the number 6 to the 
letter M A pair of columns will become mterchanged as regards then order of selection m the 
transcription process, and likely as not a repetition will be lequested by the addressee If a 
second version is sent, enciphered by the correct key, a comparison of the two versions wiU dis¬ 
close the width of the enciphermg rectangle and possibly tlie general position (left or nght) of 
the columns that were mterchanged 

6 An example wUl serve to make the matter clear Assume the two cryptograms to be as 
follows 

First Version 


ODNIL NTTHD 
IRENE NFUEH 
OOCOO ROGIO 


ODNIL 
U E H R W 
OOCOO 


NTTHD 
R P S I N 
ROGIO 


G S 0 H A 
R W R R I 
S 

Second Version 

G S 0 H A 
E N E R I 
S 


0 0 Q S G 
R A T P E 


0 0 Q S G 
R A T P E 


T E R P S 
D E T A N 


T E R N F 
D E T A N 


e The two cryptograms are superimposed as shown in figure 24 and their pomts of similarity 
and difference noted 

First version... 0DNILNTTHDGS0HA00QSGTER[PSINENE] 
d version. 0DNILNTTHDGS0HA00QSGTER[NFUEHRW 
[NFUEHRWRJRIRATPEDETANOOCOOROGIOS 
R]PSINENE]RIRATPEDETAN00C00R0GI0S 


d The two versions aie alike except for a pair of mterchanged sequences, the bracketed 
sequence PSINENEmthe first version is matched by the same sequence m the second 
veision, but at a different position m the message, likewise the bracketed sequence 
NFUEHRWRmthe first version is matched by a similai sequence m the second version, 
but at a different position m the message The vanous deductions which can be made from tlie 
situation will now be set forth 

e One of these sequences contams 7 letters, the other contams 8 It follows that the col- 
unms of the enciphermg rectangle are probably 7 and 8 letters m length, hence, with 61 letters, 
the width of the matnx is 8 Smce there are 23 letters from the begmnmg of the messages to the 
first point of their difference, it follows that there are 2 columns of 8 letters and 1 column of 7 
letters mvolved m this section [(2X8)-|-(1X7)=23], and that tlie error made m encipherment 
does not mvolve columns 1, 2, or 3, which are therefore properly placed m the first version Smce 












the sequences which are interchanged are consecutive m the text it moans that the numbers 4 
and 5 were mterchanged m the key for the first version Smce one of these sequences is of 7 
letters, the other of 8 letters, one of the numbers, 4 or 5, applies to a long column, the other, to 
a short column Smce the second version is presumably ^e correct version, and smce m the 
second version the 8-letter sequence comes first, the key number 4 apphes to a long column, the 
key number 5 to a short column m the correct version With the foregomg deductions m mmd, 
the solution and the reconstruction of the numencal key becomes a simple matter 

/ The text of the correct version is written out as seen m figure 25a Seemg a Q in column 3 
and a U in column 4, these two columns are made adjacent by slidmg column 3 one mterval down¬ 
ward, as shown m figure 256 In the latter, column 7 has also been placed at the second mterval 
to the nght of column 5, because the latter yields good tngraphs with columns 3-4 Seeing the 
tngraph T R 0 near the bottom of columns 3-4-5 and the letters 0 and P m the same row, sug¬ 
gests the word TROOP The columns are to be reairanged to make this word TROOP There are 

1 2 ^ 4 ■! 6 7 g 1 2 j 4 -i 6 7 8 3 4 7 2 6 8 1 6 

a c cONETRONETROOP 

to do a d o OFTHI OFTHIRDS 

OHONPREO OTONERPO QUADR QUADRONI 

DDQFSITR DHOFTISR SENGA SENGAGIN 

NGSUIRAO NDQUARIO GHOST GHOSTILE 

ISGENANG IGSENANG TROOP TROOPONN 

LOTHETOI LSGHOTEI EWCHE EWCHESTE 

NHERNPOO NOTROPNO RRO D RROAD 

TARWEECS THEWCEES 

TO R DO ARROD 

a bed 

Fioube 2S 

two columns which have an 0 m the piopcr row, columns 2 and 8 The trial of combmation 
3-4-5-8-6, while produemg TROOP m the proper low, gives bad pentagraphs m the other rows, 
but the combmation 3-4-5-2-6 shows excellent pentagraphs, as will be seen m figure 25c The 
words SQUADRON and HOSTILE are clearly evident, the completion of the rectangle is now a 
very sunple matter The result is shown m figure 25d The recovery of the numencal key now 
will enable other cryptograms to be read directly 

23 Messages with similar beginmngs —a In mihtary correspondence it is often the case 
that somewhat smular mstructions or information must be conveyed by a supenor commander 
to several subordmate commanders simultaneously Such a situation frequently results m the 
circumstance that two or more cryptograms addressed to different stations will begm with exactly 
the same words When simple columnar transposition is the system used for encipherment, 
then it will result, m such cases as the foregomg, that the first two or more rows of the transposi¬ 
tion rectangle will be identical m the messages which begin alike Therefore, the cryptograms 
wiU show identical sequences of two or more letters, distnbuted throughout the texts and by 
studymg these identities the cryptanalyst is able at once not only to ascertam the width of the 
rectangle but also to divide up the cipher text into sections correspondmg with the exact columns 
of the rectangle, thus ehmmatmg the only real difiiculty m solution, viz, the detenmnation of 
which are the long columns, which the short An example will demonstrate the short cut to 
solution which such a situation provides 

6 Here are two cryptograms which are assumed to have been mtercepted within a few mm- 
utes of each other, the messages bemg addressed to two battahon commanders by the regimental 
commander 
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Cryptogram 1 


B N T 

S 

E 

A R 

K 

C 

L 

C 

E 

T 

T 

N 

BITER 

R 

0 

T A 

E 

L 

T 

N 

N 

0 

N 

N 

E 

N 

0 

0 T 0 

K 

M 

S Z 

T 

G 

N 

y 

I 

T 

D 

K 

L A N A E 

F 

T 

F S 

N 

P 

G 

N 

P 

A 

R 

W 

0 

I 

A 

0 F G 

T 

F 

C T 

0 

T 

D 

N 

I 

N 

0 

E 

W X E R F 

A 

S 

I 0 

S 

T 

I 

D 

R 

R 

R 

M 

M 

A 

0 

ARP 

A 

T 

0 U 

T 

I 

0 

B 

I 

E 

0 

A 

G A A P N 

E 

I 

K 
























Cryptogram 2 














B N T 

S 

E 

I N 

D 

0 

T 

L 

C 

E 

T 

S 

APPLE 

R 

R 

0 M 

0 

I 

S 

0 

E 

N 

N 

0 

N 

S 

T 

I I U 

T 

0 

K M 

F 

E 

Y 

K 

P 

C 

Y 

I 

T D V S I 

N 

T 

A E 

F 

T F 

S 

T 

0 

N 

T 

N 

A R 

W 0 A 

R 

0 

E E 

K 

T 

F 

C 

T 

T 

L 

T 

A E A N 0 

E 

W 

X P 

V 

T 

I 

T 

I 

0 

S 

T 

T 

T F 

0 C M 

M 

A 

0 0 

S 

C 

A 

N 

R 

0 

U 

T 

I E E L S 

0 

A 

G A 

A 

A B 

I 

T 

R 

T 






e The cryptanalyst, notmg the sundanties m the first few letters of the two messages, care¬ 
fully compares the two texts, lookmg for additional identical sequences of letters between the 
cryptograms For example. No 1 begins with B N T S E and so does No 2, after an mterval 
of 4 letters m No 1 and 5 letters m No 2 he notes the identical sequences L C E T, after an 
mterval of 5 letters m No 1 and 5 letters m No 2 he notes the identical sequences E R R 0, 
and so on The identities are underlmed or marked m some distmctive manner throughout the 
texts, as shown m figure 26 

Cryptogram 1 


B N T S E 

ARK 

C 


_C_ 

_E_ 

_T T N 

BIT E R 

R 0 T A 

E 

L 

T 

N N 0 

_N N E 

N 0 

0 T 0 K M 

S 

Z 

T 

G 

N 

Y 

I 

TDK 

L A N A E 

FTPS 

N 

P 

G N P A 

R W 

0 

I 

A 

0 F G T F 

_C 

_T 

0 

T 

D 

N 

I 

NOE 

W X ERF 

A S ^ 

_S_ 

_T 

I 

D R R 

R M M A 

_0 

A R P A T 

0 

U T 

_I 

0 

B 

I 

E 0 ^ 

G A A P N 

E I K 

















Cryptogram 2 










B N T S E 

I 

N 

D 

0 

T 


GET S 

A F P L £_ 

RRO M 

0 

I 

S 

0 E N_ 

N 0 

_N 

S 

T 

I I U T 0 

K M 

F 

E 

Y 

K P 

C Y I 

T D V S I 

N T A E 

_F_ 

_T 

Z. 

_S T 0 

N T 

N 

A R 

W 0 A R 0 

E E 

K 

T 

_F_ 

_C_ 

1 

T L T 

A E A N 0 

E W X P 

V 

T 

I 

T I 0 

S T 

T 

T 

F 

0 C M M A 

0 

0 

S 

C A 

N R 

OUT 

I E E L S 

0 A G A A 

A B 

I T R 

T 
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d Now it IS obvious that these identities exist because the two messages begm alike, and 
by takmg advantage of the identical portions m the cryptograms it will be possible to transenbe 
the texts of the latter mto transposition rectangles which wiU not only have the identical por¬ 
tions m homologous positions, but also will show which are long columns, which are shoit 
All that IS necessary is to begm transcribing the texts on cross-section paper, m columns, arrangmg 
matters so that the identical sequences will fall at the tops of the columns Thus, the first 
column of No 1 will contain the letters B N T S E A R K C and the first column of No 2 will 
contam the letters B N T S E I N D 0 T, the second column of No 1 will contain the letters 
L C E T T N B I T and the second column of No 2 will contam the letters L GET S A F P L, 

324166—41-4 
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n.nf1 so on It appears tliat the identical portion embraces the first four rows of the rectangle and 
runs over a number of letters on the fifth row This is because the identical sequences consist 
of 4 and 6 letters Figure 27a shows the identities between the first 5 columns of the two trans¬ 
position rectangles Only once in the case of this particular example does any uncertamty anse 
as to exactly where an identical sequence begms or ends, and that is m connection with the 
seventh pair of identities, mvolvmg the senes of letters A E F T F S NPGNPmNol, and 
A E F T F S TONTNmNo 2 These sequences contam 6 identical letters, but even here 
the uncertamty is of only a moment’s duration The initial letter A does not belong to the iden¬ 
tical portions at the top of the transposition rectangle because the A’s are needed to complete 
columns 6 m both rectangles (If the A were placed at the head of column 7 in No 1, then 
column 6 would lack a letter at the bottom) Cases of “accidental identities” of course com¬ 
plicate the process of cutting up the text mto the respective columns, but they only serve to 
add a small degree of interest to what would otherwise be a purely cut and dned process 
The final results of the transcription into columns are shown in figure 276 



1 




2 



B 

L E 

N T 

B. 

L E 

N 

J 

N 

C R 

N 0 

N. 

A 

R N 

0 

TER 

0 K 

T 

E 

R 

^_K 

S 

T 0 

N M 

S. 

T 

0 

N 

J 

E 

T T 

N S 

E 

SMS 

F 

A 

N A 

E Z 

I 

A 

0 

T 

E 

R B E 

N T 

N F 

I 

I 

Y 

K 

I L 

0 G 

D 

P 

S 

I 

K 

C 

T T 

0 N 

0 

L 

0 

U 

P 




T 


E 


C 
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e It IS obvious from a comparison of these two skeletonized matrices, and a consideration 
of the fact that the long columns must of necessity go to the left side, that the numbers 7 and 10 
occupy the first two positions m the key, and that the numbers 2, 4, 11, and 13 occupy the last 
four positions in the key By segregating and anagrammmg columns 7 and 10 as one group, 

1 2 


1 2 j 4 5 e 7 8 9 10 11 12 13 14 


1 2 3 4 S 6 7 8 9 10 11 12 13 14 


B 

LENT 

Y 

EAT 

N 

I 

M 

0 A 

N 

C 

R N 

0 

I 

FRF 

0 

0 M U 

G 

T 

E 

R 0 

K 

T 

TWO 

E 

S 

A 

T 

A 

S 

X 

0 N 

M 

D 

F 0 T 

W T 

0 

I 

A 


ETTNSKSIOXIAOP 
ANAEZLNATiORBN 
RBENTAPODRRPIE 
KILOGNGFNFRAEI 
CTTONANGIARTOK 
P S 



L 

ENT 

Y E A T 

N 

I M 

0 

A 

N 

C 

R N 

0 

I F R F 

0 

0 M 

U 

G 

T E 

R 0 

K 

T T W C 

E 

S A 

T A 

S 

T 

0 N 

M 

D F 0 T W 

T 0 

I 

A 

E 

SMS 

F 

V S A T X 

T 0 

E 

A 

I 

A 

0 T 

E 

S T R L 

P T S 

E 

B 

N F 

I I 

Y 

I 0 0 T 

V F C 

L 

I 

D 

P 

S I 

K N N E A 

T 

0 A 

S 

T 

0 

LOU 

P 

T T E E 

I 

C N 0 R 

T 


E 

C 

A N K A 

T 

R 


T 


Fioubi 276 


and columns 2, 4, 11, and 13 as another group, the exact positions occupied by these 6 columns 
are easily ascertained, as shown m figure 27c 


4 : 


1 2 


7 10 

2 11 

13 

4 

7 10 

2 

11 13 4 

E N 

L I 
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E N 

L 

ION 

F 0 

C 0 

u 
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F 0 

C 

0 U N 

T E 

E S 

T 

0 

T E 

E 

S T 0 

F W 

T T 

I 

N 

F W 

T 

TIN 

S X 

T I 

0 

N 

S X 

S 

T E S 

N E 

N D 

B 

E 

T P 

A 

T E T 

P R 

B R 

I 

N 

0 V 

F 

F L I 

G F . 

I R 

E 

0 

N T 

P 

0 S I 

N A 

T R 

0 

0 

T I 

L 

C 0 U 

P S 




N T 
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j The remainmg columns 1, 3, 5, 6, 8, 9, 10, 12, and 14 form a third group of columns to be 
anagrammed, but this is rather easy now that the columns on either side are fixed The com¬ 
pleted rectangles are shown m figure 27d 


1 


2 


7 10 3 12 6 11 4 9 5 8 2 11 13 4 

ENEMYBATTALION 

FORMINGFORCOUN 

TERATTACKWESTO 

FWOODSATMOTTIN 

SXTAKEPOSITION 

NEARLANTZANDBE 

PREPAREDTOBRIN 
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24 Messages with similar endings —a What has been said at the begmmng at the pre- 
cedmg paragraph with respect to the nature of military correspondence and the presence of 
identical phraseology m the messages sent by a superior commander to his subordmates also 
operates to produce messages m which the endings are identical It has been noted that when 
two messages with siimlar begummgs are available for comparison, the reconstruction of the 
transposition rectangles and the recovery of the transposition key is an easy matter It will 
now be shown that solution is an even easier matter when two messages havmg identical endin gs 
are available for study 

6 Given the followmg two cryptograms 


E T R T E 
E E T R 0 
S R B E N 

T L V S X 
I V Y M R 
C I A A I 


E E S 0 A 
U D C C C 
I G S K A 

0 P N R E 
V E S I R 
N S C W N 


A E U N I 
0 H T C Y 
I L N R A 

M E F D S 
E E N E I 
A 


No 1 

V A F L N 
M R R E A 
N F N A D 
No 2 

K Y E N R 
N 0 L T M 


I A M N D 
R H I T N 
A L 0 L T 

U E E R B 
N N E D E 


R Y H R V 
D E Y E N 
X 0 M A H 

T S R E H 
TROOP 


M E N R I 
R N E R V 
H R R E I 

T I A N T 
U N A R A 














48 


The cryptanalyst now carefully compares the two texts, scarchmg for identical sequences of 
letters, but m this case instead of tiymg to locate identities m what may be termed a parallel 
progression (as m the precedmg case) he searches for identical sequences of two or more letters 
appeanng m both messages For example, m the present case, ho notes the sequence T R 0 
formmg the final tngraph of the 8th group of No 1 and finds a similar sequence forming the 
initial tngraph of the 13th group of No 2 Gomg through both cryptograms in this way, all the 
identities are marked off m some fashion, by colored crayon or underlinmg, as shown below In 
this search for identities the cryptanalyst bears in mmd that when all have been found they 
should be distnbuted at quite regular mtervals throughout the text For example, note m the 
followmg that the identities m No 1 fall at mtervals of 6 letters, with one exception, m No 2 
they fall at intervals of 4 letters, with one exception The intervals between identities serve as a 
guide m finding them After they have all been located, the identities in the cryptograms are 
numbered serially 

No 1 


E T R T E 

E E S 0 

1 

A A E U N I__V A F L N I A 

M N D 

3 

R T H R V 

M E 

N R I 

E E T R 0 

U D C C 

C 0 H T C Y 

M R R E A__R H 

I T N 

D E YEN 

R N 

E R V 

S R B E N 

9 

I G S K 

A I L N R A 

10 

N F N A D A L 

11 

No 2 

0 L T 

X 0 M A H 

“l2“ 

H R 

R E I 
"TT 

T L V S X 

0 P N R 

E M E F D S 

K Y E N R U E 

E R B 

T S R E H 

T I 

ANT 

” 1 

2 

3 

”4“ 

5 


I V Y M R 

V ^ I 

R E E N E_I 

N 0 L T M_N N E D E 

T R 0 0 P 

U N 

A R A 


CIAAI NSeW N A 


c The identities between the two cryptograms may now be equated, usmg for this purpose 
the numbers below the identities For mstance, identity 1 m cryptogram 1 matches identity 7 
m cryptogram 2, identity 2 m crytogram 1 matches identity 6 in cryptogram 2, and so on Thus 

Cryptogram 1_ 1 2 3 4 5 6 7 8 9 10 11 12 13 

Cryptogram 2.. 7 6 9 2 10 5 11 3 4 12 13 1 8 

d Now cryptogram 1 has 105 letters, since the key consists of 13 numbers (mdicated by the 

13 identities), the rectangle for cryptogram 1 contams 12 columns of 8 letters and 1 column of 9 

letters Cryptogram 2 has 81 letters, and its rectangle contains 10 columns of 6 letters and 3 
columns of 7 letters The rectangle of cryptogram 1 has but 1 long column, whereas that of 
cryptogram 2 has 3 long columns Relative to the position the last letter in each rectangle occu¬ 
pies m the last row of the rectangle, it is obvious that the last letter of the rectangle for oypto- 
gram 2 is 2 letters m advance of the last letter of the rectangle for cryptogram 1 Usmg this 
difference, mz, 2, a cyclic sequence is generated from the series of eqmvalencies given above 
Thus, the equivalent of identity 1 of cryptogram 1 is identity 7 of cryptogram 2, and the number 
7 IS placed two mtervals to thenghtof the number 1, the equivalent of identity 7 of cryptogram 
1 IS identity 11 of cryptogram 2, and the number 11 is placed two mtervals to the nght of number 
7, and so on until the followmg sequence is ob tamed 

1 2 3 4 5 6 7 8 9 10 11 12 13 

13 8 3 9 


11 
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e The equivalent of identity 9 of cryptogram 1 is identity 4 of cryptogram 2, and the num¬ 
ber 4 IS placed between the numbers 1 and 7 m this sequence, for the sequence may be regarded 
as partakmg of the nature of a cycle or a continuous senes From this pomt on, the process is 
the same as before, and finally the following is obtamed 

1 2 3 4 5 6 7 8 9 10 11 12 13 

1 4 7 2 11 6 13 5 8 10 3 12 9 

/ After little experiment it becomes obvious that column 8 belongs on the extreme left 
because m cryptogram 1 there is only one long column, number 8, ascei tamed by counting the 
number of letters between successive identities m that message The number 8 being at the 
extreme left the final actual transposition key is 8 10 3 12 91472116 13 5 The completely 
deciphered messages are shown m figure 28 


No 1 

8 10 g 12 9 1 4 7 2 11 6 18 t 

HEADREDCOLUMN 

INFANTRYANDAR 

TILLERYMARCHI 

NGNORTHREACHE 

DSILVERRUNCRE 

EKATSEVENFORT 

YAMXREMAINHER 

EINOBSERVATIO 

N 


No 2 

8 10 3 12 9 1 4 7 2 11 g 13 

INFANTRYPOINT 

REDCOLUMNPASS 

EDSILVERRUNCR 

EEKATSEVENTWE 

NTYAMXREMAINH 

EREINOBSERVAT 

ION 


g The possibility of the rapid solution of columnar transposition ciphers by means of the 
method of similar beginnmgs and endings, constitutes one of the most senous drawbacks to the 
use of transposition ciphers m military cryptography, because it is almost impossible to avoid 
such cases where many messages must be sent m the same key each day 
25 Solution of a single message contaimng a long repetition —a Sometimes a lengthy phrase 
or a series of numbers (spelled out m letters) is repeated withm a message and if the message is 
enciphered by a transposition rectangle of such narrow width (m comparison with the length of 
the repetition) that the repeated portion forms identical sequences within the text of the crypto¬ 
gram, a solution somewhat similar m prmciple to that explamed m paragraph 24 may be achieved 
within a few minutes 

b Note the following cryptogram, in which identical portions have been underlmed 


Cbyptogbam (169 letters) 

OEAEL TRS ED H N U F F R N R YF NTAED IL S M Y 

la 16 2a 

N C E T 5 L S TOC AWIAO T S L S S L E D H N 0 R I I S 

26 3a 36 

F E B N N UUP WES S M Y E RCNNO RVT TAP G N U G 

4a 46 6a 

G T I FE RSEOM SWE R N R AST BOS AAA OSNOO 

56 6a 66 

I BOS D C A Y H L HONEM SETF Y H L A U X TAP G G 

7a 76 8a 86 

PRSVL YEE G G T I S S 0 UUP V 
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c There are 18 segments of underlmed letters, which means m this case that the rectangle is 
9 columns wide, because the repeated portion m the text will give nse to two repeated sequences 
m each column This means that the rectangle has 7 columns of 19 letters and 2 columns of 18 
letters The first two segments may therefore be assigned the numbers la and 16, since they 
come from column 1, the next two segments may be assigned the numbers 2o and 26, since they 
come from column 2, and so on, as shown above Identical segments may now be equated 
Thus 


la 2a 3a 4a 5a 6a 7a 8a 9a 

36 46 26 96 86 16 66 76 56 


This gives nse to the cycle 1-3-2-4-9-5-8-7-6, which is a cyclic permutation of the actual 
transposition key 


d By transcribmg the text into a rectangle 
brmg the identical portions within the same rows. 


of proper width, “ 
the result shown 


‘cuttmg” the columns so as to 
figure 29 is obtamed 


0 

F 

T 

R 

R 

E 

A 

0 

P 

R 

E 

P 

0 

R 

T 

0 

F 

A 

E 

N 

0 

I 

C 

R 

A 

N 

R 

I 

R 

R 

E 

C 

0 

N 

N 

A 

A 

T 

C 

I 

N 

S 

0 

E 

S 

I 

S 

S 

A 

N 

C 

E 

T 

0 

E 

A 

A 

S 

N 

E 

S 

M 

V 

s 

E 

V 

E 

N 

A 

M 

A 

S 

L 

E 

W 

F 

0 

0 

N 

S 

L 

F 

0 

L 

L 

0 

W 

S 

E 

N 

T 

D 

I 

E 

R 

M 

0 

E 

Y 

E 

M 

Y 

T 

R 

I 

E 

D 

0 

R 

I 

A 

B 

V 

S 

0 

T 

E 

B 

S 

E 

R 

V 

A 

T 

I 

0 

S 

L 

0 

N 

T 

W 

I 

F 

E 

N 

W 

E 

S 

T 

0 

F 

L 

I 

"E 

S 

"t 

N 

"t 

E 

"b 

"y 

"G 

N 

E 

G 

E 

T 

T 

Y 

S 

B 

D 

M 

S 

U 

A 

R 

0 

H 

G 

U 

R 

G 

D 

A 

S 

H 

M 

0 


Y 

L 

U 

0 

N 

s 

L 

T 

U 

N 

T 

H 

0 

L 

L 

Y 

S 

Ln 

N 

_S 

P 

-G 

R 

D 

A 

I 

P 

R 

I 

N 

G 

S 

A 

N 

D 

U 

C 

S 

W 

N 

A 

C 

U 

S 

W 

A 

S 

U 

N 

S 

U 

C 

C 

F 

E 

L 

E 

U 

S 

A 

X 

S 

E 

S 

s 

F 

U 

L 

X 

E 

A 

F 

"T 

’E 

S 

"G 

T 

"y 

"T 

0 

S 

T 

0 

F 

G 

E 

T 

T 

Y 

fR 

S 

D 

"s 

G 

"b 

H 

A 

"u 

S 

B 

u 

R 

G 

D 

A 

S 

H 

N 

L 

H 

M 

T 

0 

L 

0 

u 

M 

0 

u 

N 

T 

H 

0 

L 

L 

Lr I 

Ls 

.N 

Y 

I 

S 

H 

G 

p 

Y 

S 

p 

R 

I 

N 

G 

S 

H 

Y 


0 

E 

F 

A 


G 

V 

E 

A 

V 

Y 

F 

0 

G 




e Study of figure 29 shows that columns 2 and 7 are the short columns and belong on the 
right, either m the sequence 2-7 or 7-2 The cyclic permutation of the transposition key obtained 
in subparagraph c is l-3-2-4-9-5^-7-6 In order to brmg the 2 and 7 adjacent in a sequence 
2-7 or 7-2 one must take intervals of 5 and 4, respectively, and “decimate” the cycle, giving the 
foUowmg 1-5-3-8-2-7-4-6-9 or 1-9-6-4-7-2-8-3-5 Since columns 2 and 7 belong on 
the right, the key must be 4-6-9-1-5-3-8-2-7 or 8-3-5-1-9-6-4-7-2 Only a few moments are 
necessary to establish the correctness of the former alternative and the solution is at hand It is 
as shown m figure 30 

/ A good understandmg of the prmciples elucidated m this and the piecedmg paragraph 
will enable the student to derive for himself the procedure applicable to cases of somewhat 
similar nature, such as that wherem a single letter or a whole group has been omitted from the 
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first version of a message and a second (correction message) is sent without paraphrasmg the 
ongmal text, or that wherem two messages are ahke except for a difference m a single word (such 
as a number) and are cryptographed by identical transposition keys, or that wherein the numeri¬ 
cal key has beeu incorrectly derived fiom the literal key and two versions ol the same plam text are 
available for comparison, one based on a transposition by means of the incorrect key, the second 
based on a transposition by means of the correct key, both keys, however, being of the same 
length 

26 Solution when several cryptograms of identical length and in the same key are avail¬ 
able —a Although the method to be dcscnbed in this paragraph is included within the category 
of special solutions, it is of such general applicability that it might well be treated as a general 
solution for bU transposition systems It is based upon the very mechanics of transposition as a 
cryptographic scheme, viz, that the essential feature of the transposition method consists merely 
m the alterations m the positions of the elements (letters, groups of letters, or words) composmg 
the plam text, accordmg to a specific key It follows, therefore, that the respective elements of 
two or more messages of identical lengths, when transposed accordmg to the same key, wiU undergo 
identical alterations m position m the course of encipherment, and therefore all plam-text ele¬ 
ments occupymg homologous positions m the ongmal messages will emerge m homologous posi¬ 
tions m the cryptograms The situation is very much like that which may be observed m the 
movements executed by two symmetrical groups of dancers m a chorus Suppose each group 
consists of 8 dancers startmg origmally m definite positions relative to one another When a 
movement is executed each dancer m each group performs certain evolutions, at the conclusion 
of the movement the 8 dancers in each group may be m quite different positions relative to one 
another than they were at the begmmng of the movement, but the correspondmgly numbered 
dancers m both groups find themselves m identical positions relative to their neighbors Of 
course, the fact that m this analogy the groups are based upon 8’s is of no significance, if the 
groups consisted of many more the principle would still apply Another way of looking at the 
matter is to call attention to the fact that in any type of transposition the position which a specified 
letter or element of the plain text wiU occupy in the final cryptogram is quite definitely afunawn of the 
number of letters or dements in the plain text itself For example, suppose that a plam-text message 
contains exactly 100 letters, and suppose that the transposition system and specific key is ouch 
that the 1st plam-text letter appears as the 17th cipher-text letter, the 2d plam-text letter, as the 
68th, and so on, m another message of exactly 100 letters, enciphered by the same general system 
and specific key, it is obvious that the Ist plam-text letter must also appear as the 17th cipher- 
text letter, the 2d plam-text letter, as the 68th, and so on In short, all correspondmgly num¬ 
bered plam-text letters m both messages will appear m identical positions m the cryptograms 

6 Grantmg the obvious truth of the foregomg, to what use can it be put m the solution of 
transposition ciphers’ Simply this It enables the cryptanalyst to reconstruct the plain texts of 
cryptograms of identical length without even knowing what the transposition key or system was that 
produced them The process is not at all compheated and if there are several messages the 
process is very easy It consists m supenmposmg tlie several cryptograms and anagramming 
the columns formed by the supenmposition, for it is obvious that any cu-cumstances which can 
be used as a guide for rearrangmg the letters m one of the Imes of superimposed text m order 
to form plam text will require, and can be checked by, the results of an identical rearrangement 
of the correspondmg letters of the other Imes of superunposed text 

c An example of the method mvolvmg the application of this general solution will now 
be given, iiHing as a basis five messages assumed to have been enciphered by an unknown but 
complex type of transposition It will now be shown how the security of such a system is demol¬ 
ished when it IS used by a large number of mtercommunicatmg commands 
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d Let the following be five cryptograms isolated from among many messages mtercepted 
on the same day and therefore suspected of bemg m the same key These five cryptograms 
have been isolated because they all contam exactly the same number of letters They are here 
shown superimposed (fig 31) and therefore aU the letters m one column have undergone exactly 
the same evolutions or changes m position m the course of encipherment 

ColmnnNo.- . . 1 2 3 4 S 6 7 8 ‘> in 11 12 13 H 15 Ifl 17 18 19 20 21 23 M 24 2g aft 27 28 29 30 31 32 

MessageNo 1 lAALNEOFSGTOGVERANOLNDUODEIHISAT 

MessageKo 2 -TDNMRGREONARIEUETNYITCOFEAIEUTTA 

MessageNo 3. ANELNEXEHGILACEMEENLFXTEEEISIGAO 

MessageNo 4 EENETSLNNFTCOIDOSEAILFIGDWIAARNO 

MessageNo s -RAMETMIONODIUMALLINXOATGTNNAIBTN 

Column No - . - 33 34 38 36 37 88 3 9 40 41 4 2 43 44 4S 46 47 48 4Q BO SI 

MessageNo i FTDNRLVORODSWEERORQ 
MessageNo 2. RDTEDNSOEIPECMFEARN 
MessageNo 3 - RWLLDLVVORDELOCHOTH 
MessageNo 4 - IHNLLNRFVWLREMRAIEA 
MessageNo s - HITNIASDRMSECUIOVSA 

Fioueb 31 


e Notmg a Q iii message 1 column 51, the obligatory sequence Q U is assumed to be present 
in that message There is in message 1 but one U, which is fortunate Combmmg columns 61 
and 23, the results are found to be fair (fig 32a) The H T in the third low suggests a word 
ending m G H T, such as FIGHT, MIGHT, EIGHT, etc Searchmg m message 3 for a G, two candi¬ 
dates are found columns 10 and 30 The trigraphs yielded by each combmation are shown m 
figure 326 The second of the two possibilities looks much the better The trigraph m the 



10_8I^ 

T0_;t_23 

Q U 

G Q U 

S Q U 

N 0 

N N 0 

T N 0 

H T 

G H T 

G H T 

A I 

F A I 

R A I 

A T 

OAT 

BAT 


SQUA SQUAD 
TNOT TNOTC 
GHTA GHTAX 
RAIN RAINF 
BATT BATTA 


nouBi 32a 




nroBs 83a 


ricuB* 333 


first row suggests the word SQUARE or SQUADRON, that m the last row suggests BATTLE or 
ATTALION This means that a column with an A at the top and a T at the bottom should be 
sought There is only one such column, 31 Addmg it to the 30-51-23 combmation gives 
what IS shown m figure 33o Lookmg for a column with a D at the top (for SQUAD) and either an 
A (for BATTALION) or an L (for BATTLE), there is only one candidate, column 22, yieldmg the 
sequences shown m figure 336 Enough has been shown of the procedure to make further demon¬ 
stration unnecessary Once a good start has been made, progress is quite rapid, iiTilona the 
cryptanalyst is unfortunate and arrives at a pomt where aU the messages simultaneously ter- 
mmate m complete words, without a clue as to what follows or precedes m any one of the mes¬ 
sages In such a contmgency the only thmg he can do is to try aU sorts of possible contmuations, 
either “fore” or “aft,” that is, m front of the ongmal startmg pomt or after it, until he picks up 
another word which will enable hun to contmue Or he may have to search for a new pomt of 
entry and build upon that, later ]ommg this structure with the other In the case under ex- 
ammation no senous difficulties are found and the entire set of five messages is reconstructed 
/ In the course of this reconstruction the numbers applicable to the columns become assem¬ 
bled m proper sequence, that is, m the correct order to reproduce the plam text. This sequence, 
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constitutmg the C->P sequence, is shown m figure 34 as the second row of numbers 

Term number .. . 1 2 3 4 S 6 7 8 <» 10 11 12 13 14 IS 16 17 18 19 20 21 22 23 24 24 26 27 28 29 30 

C-»P sequence . 28 8 14 46 19 37 26 47 48 26 35 41 2 34 27 12 36 45 17 13 40 18 » 24 33 g 1 60 44 11 

MessageNo 1 „„ HAVEORDEREDRATIONWAGONSOFFIRST 
MessageNo 2._. .. ENEMYDEFEATEDDIRECTIONOFRETREA 
MessageNo 3. .. SECONDECHELONWILLLEAVEHEREATEI 

MessageNo 4 _ANIMALDRAWNVEHICLESOFENGINEERT 

MessageNo 5 _ AMMUNITIONTRAININCLUDINGHORSED 

Term number__ 31 32 33 34 35 36 37 38 39 4 0 41 42 43 44 41 46 47 48 49 Sn 51 

30 51 23 31 22 16 7 21 32 42 10 4B 4 43 15 5 39 29 20 38 6 

SQUADRONTOGOLDENVILLE 
TNOTCERTAINAMPURSUING 
GHTAXMXFORGOLDENVILLE 
RAINFOLLOWFIELDTRAINS 
BATTALIONMOVESATSIXAM 

FiaUBI 34 

g The solution by superimposing and anagrammmg equal-length messages m the case of 
transposition constitutes a general aolutwn which is applicable m all cases without exception 
Indeed, the possibility of solution by tlqs method constitutes the most serious, if not fatal, weak¬ 
ness of transposition as a cryptographic method, for not only is it applicable to the most complex 
as well as to the most simple types of transposition, but, what is much more senous, the pro¬ 
cedure 18 very simple, requmng very little cryptanalytic mgenuity or expertness The chief 
disadvantage of this general solution is, of course, that it is dependent upon the more or less 
fortuitous availability of messages of identical lengths, and while this fortunate contmgency is 
qmte frequent m a volummous correspondence, it would naturally be better from the pomt of 
view of the cryptanalyst if this requirement were not essential m all cases Deeper study of 
the subject will show that the method can still be applied m a modified way to the case of mes¬ 
sages of alm ost the same lengths when the transposition is not too mvolved To illustrate, 
a case of simple keyed-columnar transposition will be used and it will be assumed that several 
messages of approximately identical lengths are at hand 

h First, take the case of two messages which have been enciphered by completely-filled 
rectangles, one message havmg, for example, one more row of letters than the other In the 
discussion, the consecutive numbers 1, 2, 3, will be employed as though they constituted 
the successive letters of a plam-text message that is being enciphered This method of treat¬ 
ment 13 very useful m connection with studies of the mechanics of transposition ciphers in 
general, and especially so m the case of double transposition Note the P->C sequences that 
result from the transposition 

6 2 5 7 4 1 3 6 2 5 7 4 1 3 

01 02 03 04 05 06 07 01 02 03 04 05 06 07 

08 09 10 11 12 13 14 08 09 10 11 12 13 14 

15 16 17 18 19 20 21 15 16 17 18 19 20 21 

22 23 24 25 26 27 28 B 

A 

P-»C sequence for A—. 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 
08 15 22 04 11 18 25 

P-»C sequence for B_ 06 13 20 02 09 16 07 14 21 05 12 19 03 10 17 01 08 15 04 11 18 

riQUBE 35a 


C-»P lequence_ 

MessageNo 1 

Message No 2__ 

Message No 3_ 

Message No 4 . . „ 
Message No 5 .... 
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It IS obvious that the two sequences may be superimposed so as to bring identical sections mto 
superimposition Thus 


A_ 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 08 15 22 04 11 18 25 

B. 06 13 20 □ 02 09 16 □ 07 14 21 □ 05 12 19 □ 03 10 17 □ 01 08 15 □ 04 11 18 □ 


The 7 blank spaces m the B Ime mark the ends of the columns m the transposition rectangle 
The regularity m the distnbution of the blank spaces follows from the mechanics of encipherment 
If two messages were superimposed m this manner it is clear that a solution by anagrammmg 
becomes perfectly feasible Moreover, anagrammmg of columns is perhaps unnecessary, for 
anagrammmg merely the letters that would occupy m Ime A the positions marked by the blanks 
m Ime B will yield the transposition key duectly Extension of these prmciples to the case m 
which the two rectangles differ by 2, 3, 4, complete rows is obvious 

% Taking next a case wherem two rectangles differ by one or two letters m the bottom row, 
it IS clear that by shiftmg the letters of one message one or two spaces to the right (or left) from 
a given pomt will bru^ most of the text mto proper superimposition for a solution by anagram¬ 
mmg Note the P-»C sequences applicable to the foUowmg transpositions 


6 2 5 7 4 1 3 
01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
22 23 24 25 26 27 
A 


6 2 5 7 4 1 3 

01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
22 23 24 25 
B 


P->C sequence for A... 06 13 20 27 02 09 16 23 07 14 21 05 12 19 26 03 10 17 24 01 08 
15 22 04 11 18 25 

P-^C sequence for B... 06 13 20 02 09 16 23 07 14 21 05 12 19 03 10 17 24 01 08 15 22 
04 11 18 25 

Figurb <166 


It IS possible to superimpose these two sequences by shiftmg the sections m Ime B after certam 
numbers Thus 

A. ..06 13 20 27 02 09 16 23 07 14 21 05 12 1£ 26 03 10 17 24 01 08 15 22 04 11 18 25 

B. ..06 13 20 □ 02 09 16 23 07 14 21 05 12 19 □ 03 10 17 24 01 08 15 22 04 11 18 25 


In the case of actual messages correspondmg to the foregomg P-»C sequences, superimposition 
of the two texts m the manner indicated would at once permit of a solution by anagrammmg of 
columns The unknown factor, of course, is the location of the blank spaces Where the two 
messages differ m length by only one or two letters bnef expenmentation would tell the story, 
where the messages differ m length by a good many letters the process would be much more 
difficult but not at all hopeless of fruitful results Only a small section of text reconstructed by 
anagrammmg will soon lead to complete solution Hence, it follows that by regulating the num¬ 
ber of blanks to be left here and there and judicious shiftmg of sections of text, solution by super- 
imposmg and anagrammmg homologous sections of text from several messages m the same trans¬ 
position key will often be possible 
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j The foregomg prmciples will naturally not be applicable to cases where two messages differ 
in length by but one letter and this small difference brings about a profound difference m the P-»C 
sequences applicable to the messages This is what happens often m the case of true double 
transposition,* but the prmciple can nevertheless be applied even here An explanation of the 
procedure lies beyond the scope of the present text, however, and no more will be mdicated herem 
concerning the matter m the case of true double transposition However, m certam cases of 
combmed substitution-transposition to be discussed m a later portion of this text the prmciples 
elucidated m these last few subparagraphs may be found to be applicable 

27 Reconstruction of the keys in double transposition —o Havmg reconstructed the plain 
texts of the messages solved by superimposing and anagrammmg, as explamed m paragraph 
26 d, e, can the transposition key be found? First, it is necessary to ascertain whether a smgle 
columnar transposition had been used and, if not, then the assumption will be that a double 
transposition had been used 

6 If a smgle transposition were the case, the relationship pom ted out m paragraph 16c, con- 
cemmg the existence of a constant difference between successive elements of the P-»C sequence, 
should obtam Havmg the C->P sequence, the P->C sequence may readily be established by 
inversion of the former Hence, the P—>C sequence is constructed by mversion, as shown m 
figure 36a 

Term number_ i 2 8 4 5 6 7 8 9 10 ii 12 13 14 16 16 17 is w 20 21 

C-»P sequence... 28 3 14 46 19 37 25 47 48 26 35 41 2 34 27 12 36 45 17 13 40 

2223242626272829 30 31 32 33 34 35 36 37 38 39 40 41 42 

18 9 24 33 8 1 50 44 11 30 51 23 31 22 16 7 21 32 42 10 49 

4344 46 46 47 48 49 60 61 

4 43 15 5 39 29 20 38 6 

Term number 1 2 3 4 s e 7 8 9 10 11 12 13 14 16 lo 17 is 19 20 21 

P-+C Bequence'-- 27 13 2 43 46 51 37 26 23 41 30 16 20 3 45 36 19 22 5 49 38 

222324262627282930 31 3233343636 37 383940 41 42 

35 33 24 7 10 15 1 48 31 34 39 25 14 11 17 6 50 47 21 12 40 

43 44 46 46 47 48 49 60 51 

44 29 18 4 8 9 42 28 32 

FlOUBB 36a 

e (1) Smce there appears to be no constant difference between successive terms m the 
P C sequence m figure 36o, smgle columnar transposition is ruled out and double transposition 
18 assumed to have been employed In passing, it is worthwhile noting that the reconstruction 
of the keys employed m the case of true double transposition is qmte important, because it is 
often the case that concentrated effort directed toward the cryptanalysis of one or more messages 
and the subsequent recovery of the transposition keys will, of course, greatly facilitate the 
ren ding of all Other messages in the same keys 

(2) There are at least four methods smted to the puipose and they will be dealt with in an 
order most conducive to their comprehension by the student 

(3) A prelimmary to the reconstruction of the keys m the case of each of the four methods 
to be studied consists m establishing or ascertammg the width of either the T-1 or the T-2 
matrix, usually the former, because it is easier to do 

‘ See Special Text No 166, Advanced Mdytary Crypiography, sec IV 
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(4) As m paragraph 26A, the exposition will employ matrices m which the consecutive 
numbers 1, 2, 3, take the place of the successive plam-text letters m the T-1 matrix, 
because m such handling significant facts arising from the mechanics of encipherment are brought 
to hght 

d In order to study the effects of true double transposition on this matter of reconstructing 
the keys an example will be employed, mvolvmg transposition with two different keys Let 
the “message” and the keys be as shown m figure 37a 



3917 42 11 8 10 65 

01 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 40 
41 42 43 44 45 46 47 48 


04 12 20 28 36 44 02 10 18 26 34 
42 50 06 14 22 30 38 46 08 16 24 
32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 







T-1 T-2 


Term number_ 

C P sequence- 


-- 01 

02 

03 

04 

05 

06 

07 

08 

00 

10 

11 

12 

13 

_20 

06 

48 

33 

15 

44 

30 

21 

03 

39 

04 

42 

32 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

34 

25 

26 

17 

51 

36 

22 

13 

49 

31 

34 

24 

09 

43 

26 

16 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

01 

35 

28 

14 

05 

41 

23 

10 

46 

37 

19 

12 

50 

40 

41 

42 

43 

44 

45 

46 

47 

48 

48 

50 

81 


40 

25 

07 

18 

08 

45 

27 

02 

38 

29 

11 

47 


- - - 01 

02 

03 

04 

05 

06 

07 

06 

09 

10 

11 

12 

13 

_ 27 

47 

09 

11 

31 

02 

42 

44 

23 

34 

50 

38 

18 

14 

18 

16 

17 

18 

10 

20 

21 

22 

23 

24 

25 

26 

30 

05 

26 

14 

43 

37 

01 

08 

17 

33 

22 

41 

25 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

46 

29 

49 

07 

20 

13 

04 

21 

28 

16 

36 

48 

10 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 


40 

32 

12 

24 

06 

45 

35 

51 

03 

19 

39 

15 



Hoou 37a 


Nof^g m the nature of a senes of constant differences between successive terms is now discenuble 
m the P C sequence But there is, as can readily be seen, a fairly constant relationship 
betw^ segments or sections of this sequence For example, take the 1st to 6th terms of this 
P -> C sequence (20 06 48 33 16), set them under the 29th to 34th terms (28 14 05 41 
23), and find the difference between superimposed numbers (When the minuend is less than 
the subtrahend the supenmposed terms are disregarded ) Thus 

29th to 34th terms... 28 14 05 41 23 

1 st to 6th terms. 20 06 48 33 15 

Differences. 8 8 8 8 


There is a constant difference between the supenmposed terms The reason for its appearance 
IS not hard to understand if reference is made to figure 37a and the matter is studied m the light 
of the mechanics of the method of encipherment As for the two terms 28 and the 20, while 
they come from different columns m the T-2 matrix, both come from the same column of the 
T-1 matnx, as do 14 and 06, 41 and 33, 23 and 15 But the 05 and the 48 not only come from 
different columns in the T-2 matrix, but also from different columns m the T-1 matnx, this 
lopresentmg a case where there is a transit from the bottom of one column to the top of the next 
column m the transposition process Now the constant difference is m this case 8 because 
the supenmposed terms happen to be sequent m the columns m which they fall m the T-1 matnx 
If the supenmposed terms are in the same column in the T-1 matrix but separated by one row, 
the constant difference will be 16, if separated by two rows, the constant difference will be 24, 
and so on Thus, for example 

6th to 11th terms__ 44 30 21 03 39 

29th to 34th terms___ _ 28 14 05 41 23 

16 16 16 16 

Here the difference, 16, is a multiple of 8 because the supenmposed terms are separated by one 
row m the T-1 matnx, as can be seen by refemng to figure 37a 

e The foregomg phenomena afford a method of ascertammg the width of the T-1 matnx 
m an unknown case, and, as noted above, this constitutes the first step m recovenng the transposi¬ 
tion key or keys For if a study be made of the terms of the P -> C sequence in figure 36a, 
based upon findin g sections thereof which show a constant difference, the latter will correspond 
to either the width of the T-1 matnx or a multiple of the width An easy way to make this 
study IS to take a section of the P -> C sequence m figure 36a, add 5, 6, 7, (m successive 
steps) to each term of the selected section, and then look for repetitions between the ongmal 
P -> C sequence and the P ^ C sequence plus the additive A begmnmg will be made with an 
assumption of a T-1 matnx of 5 columns Since the cryptograms contain only 61 letters, all 
totals greater than 51 wiU be disregarded Hence it is best to take a section which has a long 
senes of low numbers, so that when the additive is applied the majonty of the totals will not 
exceed 51 Such a senes is the foUowmg (only one term m it, the 29th, is close to the m aximum ) 
number. 21 22 2324252627282930 31 33 33343538 37 

P-resequence_ 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 

P-resequence+5-- 43 40 38 29 12 15 20 06 36 39 44 30 19 16 22 11 

Searching for repetitions between the P-»e sequence and the P-re sequence -f 5, the results are 
negative Tnal is then made of additives 6 to 11, mclusive, with similar negative results When 
an additive of 12 is applied, however, the results obtamed give positive mdication that the T-1 
matnx is 12 columns m width Thus 

Term number.. 21 22 23 24 25 26 27 28 26 30 31 32 83 34 35 36 37 

P^C sequence. 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 

P^ sequence+12_ 50 47 45 36 19 22 27 13 43 46 61 37 26 23 29 18 

It will be seen, on refemng to figure 36a, that the followmg repetitions (with the term numbers m 
each of the sequences mdicated) are present 

Term no in P-4C sequence + 12 21 22 23 24 25 26 || 27 28 29 30 31 32 33 34 35 36 37 

Repetitions..... 50 47| 45 36 19 221| 27 13 02 43 46 51 37 26 23 29 18 

Term no m P->0 sequence 38 39 15 16 17 18 | 01 02 03 04 05 06 07 08 09 44 45 

The width of the T-1 matnx is therefore 12 and its outlmes may at once be drawn, smee the total 
number of letters in each message, 51, mdicates that there are 3 long columns of 5 letters and 9 
short columns of 4 letters 
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y (1) There is another method of ascertammg the width of the T-1 matrix, which is perhaps 
a bit shorter and more direct than that described above Basically both methods are the same, 
the one now to be presented bemg but another way of lookmg at the matter Suppose that the 
differences between successive terms m the P-^C sequence of figure 37a are calculated and set 
down as shown below, and then repetitions are sought m the senes of differences, the latter 
constituting what will hereinafter be termed the P-^G interval sequence Thus 


Term number. oi 20 os 04 os o« 07 os 00 10 ii 12 is u is 

P-»C sequence. 20 06 48 33 15 44 30 21 03 39 04 42 32 17 51 

P^C interval sequence. . -14 + 42-15-18 + 29-14 -9-18 + 36-35+38-10-15 + 34-15 


Term number. lo it is i« 20 21 22 23 24 

P->C sequence.. 36 22 13 49 31 34 24 09 43 

P->C mterval sequence... —14 —9 + 36 — 18 +3 — 10 — 15 + 34 — 17 


Term number ... 25 20 27 2s 29 so 31 32 ss 34 ss so 37 

P->C sequence... 26 16 01 35 28 14 05 41 23 10 46 37 19 

P->C mterval sequence. -10-15 + 34 -7 -14 -9 + 36-18 — 13 + 36 —9 — 12 —7 


Term number.. . -- ss 39 40 41 42 43 44 4s 4s 47 4s 49 so si 

P->C sequence -- 12 50 40 25 07 18 08 45 27 02 38 29 11 47 

P->C mterval sequence-- +38-10-15 -18 + 11-10 + 37-18-25 + 36 -9-18 + 36 


Fioubi 376 

Several repetitions are noted and underscored, m the same manner that ordmary repetitions are 
indicated m analogous cryptanalytic procedure Kow take the longest repetition, —14—9+36 
— 18, and find the terms from which it originates in the P^C sequence, a constant difference of 
8 will be found Thus 

(Term numbers 16-20)_ 36 22 13 49 31 

(Term numbers 29-33)_ 28 14 05 41 23 

Differences.... 8 8 8 8 8 

The other repetitions will show the same constant difference The terms which produce the 
repetitions will be found to be located m the same columns of the T-2 matnx m figure 37o, and 
reference to that figure will show that the constant difference between the sets of terms produemg 
repetitions in the P-h>C interval sequence is merely the result of the mechanics of encipherment 
(2) In similar manner, if the mterval sequence is constructed for the P^C sequence of 
figure 36a, the repetitions underscored m figure 366 are noted 


Term number. oi 02 03 04 os o« 07 os 09 10 11 12 13 14 is 

P^C sequence. 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 

P-^C interval sequence.. -14-11 +41 +3 +5 -14-11 -3 + 18-11-14 +4-17 + 42 -9 


Term number. n 17 is 19 20 21 22 23 24 

P-»C sequence. 36 19 22 05 49 38 35 33 24 

P-»C mterval sequence.. -17 +3-17 + 44-11 -3 -2 -9-17 

Term number . 2s 20 21 2s 29 30 31 32 33 34 3s 3s 37 3s ss 

P-»C sequence... 07 10 15 01 48 31 34 39 25 14 11 17 06 50 47 

P-»C mterval sequence.. +3 +5-14 + 47-17 +3 +5-14-11 -3 +8-11 + 44 -3-26 


Term number.. 4o 41 42 43 44 4s 46 47 4S 49 so si 

P->C sequence- 21 12 40 44 29 18 04 08 09 42 28 32 

P-»C mterval sequence... -9+28 +4-15-11-14 +4 +1+33-16 +4 


Fioubc 366 


J 
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Takmg the sections of the P->C sequence from which the longest repetition arises and findmg 
the constant difference between the terms mvolved, a width of 12 for the T-1 matnx is mdicatcd 
Thus 

(Term numbers 04-09).. ... 43 46 51 37 26 23 

(Term numbers 30-35). 31 34 39 25 14 11 


Differences. 12 12 12 12 12 12 

This 18 identical with the results found by the other method The T-1 matrix for the messages 
of paragraph 26d is therefore 12 columns m width 

g Havmg ascertamed the width of the T-1 matnx, the next step is to ascertam whether 
the width of the T-2 matrix is the same as that for the T-1, or different If the same, the sus¬ 
picion 18 warranted that the transposition keys for both matnees may be identical, m which case 
it IS necessary to recover but one key If the widths of the two matnees are different, then 
it IS obvious that two different transposition keys are mvolved Havmg ascertamed the widths 
of both matnees, one can proceed to reconstruct the transposition key or keys which apply 
thereto There are, as stated once before, at least four methods suitable for this purpose They 
will now be taken up m turn, and each method will be explained m detail 

h (1) In explammg the first method the discussion will be mitiated with a reconsideration 
of figure 37a If the C-»P sequence established m that figure is treated as though it weie plam 
text and enciphered by the double transposition method, usmg the same two transposition keys 
as before, an mterestmg phenomenon is observed I^ot the following (fig 37c) 


27 47 09 11 31 02 42 44 
23 34 50 38 18 30 05 26 
14 43 37 01 08 17 33 22 
41 25 46 29 49 07 20 13 
04 21 28 16 36 48 10 40 


11 38 01 29 16 06 47 34 43 25 21 

12 39 02 30 17 07 48 35 44 26 22 

13 40 03 31 18 08 49 36 45 27 23 

14 41 04 32 19 09 50 37 46 28 24 



OA UO ^0 00 Oi Uo 


m usf 10 1 



T-1 T-2 


Fioitbe 37c 

Here it is seen that the numbers m the columns of the T-2 matnx are consecutive Obviously, if 
the columns of this T-2 matrix were retranscribed m a matnx of the same outlmes as the T-1 
matnx, the numbers would be consecutive m rows and would lepresent the plam-text sequence 
1, 2, 3, , msenbed withm a T-1 matrix m the normal fashion Thus (fig 37d) 

6 2 7 1 6 3 8 4 

01 02 03 04 05 06 07 08 

09 10 11 12 13 14 15 16 

17 18 19 20 21 22 23 24 

25 26 27 28 29 30 31 32 

33 34 35 36 37 38 39 40 

41 42 43 44 45 46 47 48 

49 50 51 I- 


FIOUBB 37|( 



































The result of these three steps has been to effect a return to the original T-1 matrix contammg 
plam text m normal sequence The pnncipal point to be noted here is the appearance of the 
T-2 matrix m figure 37c, for it is the basis of the first method for recovering the transposition 
keys, as well as for other operations in connection with double transposition 

(2) To demonstrate the procedure, the data afforded by figure 37a agam wdl be employed 
Let the C-»P sequence be inscribed within a matrix of 8 columns (the width havmg been estab¬ 
lished by one of the methods set forth in subpais d-f) Thus 

1 a 3 « t a 7 8 

27 47 09 11 31 02 42 44 

23 34 50 38 18 30 05 26 

14 43 37 01 08 17 33 22 

41 25 46 29 49 07 20 13 

04 21 28 16 36 48 10 40 

32 12 24 06 45 35 51 03 

19 39 15 I--- 

Figubi 37e 


Find the column m which term 01 appears and set that column down homontaUy, placmg a 
vertical bar before and after the senes of numbers to set them off as belongmg to one column 

Step (1) I 11 38 01 29 16 06 | 

Fiqub* 37/ (1) 


Then find the column m which the term 02 appears and set it down under the row of numbers 
given m Step (1) Thus 


Step (2) 


I 11 38 01 29 16 06 | 

I 02 30 17 07 48 35 | 


Figvbe 37/(2) 


Note the ascendmg superimposed numbers 01, 02, 29, 30, 16, 17, 06, 07 Contmue to biuld up 
on this structure m the manner depicted m successive steps as follows 


I 11 38 01 29 16 06 | 

Step (3) I 02 30 17 07 48 35 | 

I 44 26 22 13 40 03 | _ 

I 11 38 01 29 16 06 1 

Step (4) I 02 30 17 07 48 35 | 

I 44 26 22 13 40 03 | 

I 27 23 14 41 04 32 19 | _ 

I 11 38 01 29 16 06 | 

I 02 30 17 07 48 35 | 

Step (5) 144 26 22 13 40 03 | 

I 27 23 14 41 04 32 19 | 

_ 142 05 33 20 10 51 | 


Figure 37/(3) (4) (S) 


The numbers 01 to 05, mdusive, here have formed the basis for buddmg up the structure shown 
as Step (5) The next term m the sequence is 06 but it is already m the structure, as is also 07 


ei 


In the column ui which 06 and 07 appeal there is just room enough foi 08 and 09, since the teim 
10 IS already shown at the bottom of the column Hence 

ill 38 01 29 16 061 

|02 30 17 07 48 35] 

Step (6) I44 26 22 13 40 03l31 18 08 49 36 45| 

|27 23 14 41 04 32 19| 

_ |42 05 33 20 10 511 

111 38 01 29 16 061 

|02 30 17 07 48 351 

Stop (7) 144 26 22 13 40 03|31 18 08 49 36 451 

|27 23 14 41 04 32 19109 50 37 46 28 24 15| 

_ 142 05 33 20 10 511 

111 38 01 29 16 06| 

|47 34 43 25 21 12 39j02 30 17 07 48 35i 

Step (8) 144 26 22 13 40 03|31 18 08 49 36 451 

|27 23 14 41 04 32 19|09 50 37 46 28 24 15| 

'42 05 33 20 10 511 


The process is continued m this inannei until, as shown m figure 37/(9), all the numbers of the 
C^P sequence have been plated (Here the last number is 51 ) 

111 38 01 29 16 06|47 34 43 25 21 12 391 

|47 34 43 25 21 12 39|02 30 17 07 48 35|44 26 22 13 40 03| 

Step (9) |44 26 22 13 40 03|31 18 08 49 36 45|27 23 14 41 04 32 19| 

127 23 14 41 04 32 19|09 50 37 46 28 24 151 

|09 50 37 46 28 24 15|42 05 33 20 10 51| 


The T-2 matiix may now be cliawn within the confines of the structure shoivn m this last figure 
The positions of vertical lines to be placed at the left and right to maik the exact outlines of the 
matrix may now readily be found by referring to the matiix in figure 37e It is obvious that the 
column with the terms 11-15 belongs at the extreme left of the T-2 matrix, the column with the 
terms 21-24 belongs at the extreme right The transposition key foi the matrix may then be 
established directly from the matnx itselt, by following the sequence of numbers m the columns 
Thus 


11 38 01 29 16 06|47 34 43 25 21 12 391 

|47 34 43 25 21 12 39|02 30 17 07 48 35|44 26 22 13 40 03| 

|44 26 22 13 40 03|31 18 08 49 36 45|27 23 14 41 04 32 ] 

|27 23 14 41 04 32 19|09 50 37 46 28 24 15| 

|09 50 37 46 28 24 15|42 05 33 20 10 51 |- 
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Reference to figure 37c will show the exact coirespondence between the T-2 transposition key 
and the T-2 matrix of figure 37g with these same elements mdicated in figure 37c The trans¬ 
position key for the T-1 matrix in figure 37c can now easdy be derived from figure 37g It 
must be as follows 

6 8 7 1 5 3 8 4 

27 47 09 11 31 02 42 44 

23 34 50 38 18 30 05 26 

14 43 37 01 08 17 33 22 

41 25 46 29 49 07 20 13 

04 21 28 16 16 48 10 40 

32 12 24 06 45 35 51 03 

19 39 15 I- 


This tiansposition key aiul T-1 matn\ aie identical with the key and T-1 matrix of figuic 37c 
i Note the application of the foiegomg method to the C—>P sequence shown in fig^ure 36o 
in connection with the messages solved in paiagraph 26d-c It has alieadv been found that the 
width of the T-1 matiix is 12 The C->P sequence of figure 36a is therefore insciibed within a 
matrix of 12 columns 


28 03 14 46 19 37 25 47 48 26 35 41 

02 34 27 12 36 45 17 13 40 18 09 24 

33 08 01 50 44 11 30 51 23 31 22 16 

07 21 32 42 10 49 04 43 15 05 39 29 

20 38 06 I--- 


The process explamed in subpaiagiaph A (2) above is now applied The successive steps have 
been omitted but the final lesult is shown herewith 

I 14 27 01 32 06 | 19 36 44 10 1 

I 48 40 23 15 1 28 02 33“ 07 20 | 37 45 11 49 | 

I 41 24 16 29 I 03 34 08 21 38 | 46 12 50 42 | 

I 25 17 30 04 I 35 09 22 39 I 47 13 51 43 j 

I 26 18 31 05 I 


All the numbcTs fiom 01 to 51, mclusi\e, are contamed withui this structujc Extendmg it to 
the left or right to make the T-2 matrix complete, by icfeirmg to the T-1 matrix, it is found 
that the stnicturc must be made as shown heiewith 


7 1 8 2 6 9 11 3 12 10 6 




14 

27 

01 

32 

06 

1 19 

36 

44 

10 

|48 

40 

23 

15 

1 


48 40 

23 

15 

1 28 

02 

33 

07 

20 

137 

45 

11 

49 

141 

24 

16 

29 

1 

|41 

24 

16 

29 

1 03 

34 

08 

21 

38 

1 46 

12 

50 

42 

1 25 

17 

30 

04 1 


1 25 

17 

30 

04 

1 35 

09 

22 

39 

liL 

13 

51 

43 

j 26 

18 

31 

05 1 


1 26 

18 

31 

05 y 
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The transposition key for the T-1 matiix is now found to be as indicated at the top of figure 36c 
j A second method for reconstructmg the keys wnll now be explained To demonstrate 
this method the data afforded by figure 37o will agam be employed Gomg back to the pomt 
where the P->C mterval sequence for this example was established m subparagraph/(I) above, 
the terms, in figiue 376, which gave nse to the thnce-appeaimg repetition m the mterval sequence 
(—10 —15 -f 34) are found to be as follows 

1st appeaiaiice (teiiu iiunibeis 12-16). 42 32 17 51 

2d appeaiaiice (term numbers 21-25) . 34 24 09 43 

3d appearance (term numbers 25-29) . 26 16 01 35 

Fiodss 37i 

These sequences may be learianged so as to bimg the numbeis m ascendmg order withm 
columns Thus 

26 16 01 35 
34 24 09 43 
42 32 17 51 

Figubb 37y 

The constant difference, 8, within the columns of this structure is, of course, the same constant 
difference as was foimd before, and corresponds with the width of the T-1 matrix It derives 
from the T-1 matrix, as may be seen on leferrmg to figure 37o The columns of the structure 
m figure 37j are seen to be poitions of the T-1 matrix, lymg m the followmg positions m that 
matnx 

"oT 

09 
17 

26 

34 35 
42 43 

_ 

Figubb 378 

In the T-2 matnx these numbeis fall in the following positions 


26 34 
. 16 24 

01 09 
35 43 

_ 1 

Figubb 371 

Now if the dimensions of the T-2 matrix were unknovm, these numbers could nevertheless be 
placed m a skeletomzcd T-2 matnx as follows 

26 34 42 
16 24 32 
01 09 17 
35 43 51 

Figubb 37ni(l} 


42 

32 

17 

51 


16 

24 

32 


I 
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and the block of numbers could be extended on both sides by referring to the T-1 matrix m figure 
37o Thus 

I 02 10 18 26 34 42 50 

I 08 16 24 32 40 48 | 

01 09 17 25 33 41 49 1 

I 01 11 19 27 35 43 51 

liouHx 17m(2) 

This stiuoturc may next be extended by lefornng to tlie P-*C sequence in figure 37a, by com¬ 
pleting the pnitial columns of the stiuituie 

44 I 02 10 18 26 34 42 50 06 14 22 

30 38 46 I 08 16 24 32 40 48 | 05 13 

21 29 37 45 01 09 17 25 33 41 49 

103 11 19 27 35 43 51 07 15 23 31 

IlQUEE 37»«(3) 

Again the structuie may be extended bv lefeiring to tJie T- 1 matrix Thus 

04 12 20 28 36 44 02 10 18 26 34 42 50 06 14 22 30 38 46 

06 14 22 30 38 46 08 16 24 32 40 48 05 13 21 29 37 45 

05 13 21 29 37 45 01 09 17 25 33 41 49 

03 11 19 27 35 43 51 07 15 23 31 39 47 

]<IGDRE j7)»(4) 

Noting tlie djipeaiance of the teirn 06 in the 1st low and also in the 2d low of the stiuctuic, the 
latter may be tiansciibed as follows 

42 50 06 14 22 30 38 46 

32 40 48 05 13 21 29 37 45 

17 25 33 41 49 

51 07 15 23 31 39 47 


By referring to the T- 1 matiix of figure 37a and the foregoing structuie, the key foi T-1 can be 
recovered It is 6-2-7-l-5-3-8^ By rcfeiring to the P->C sequence in figure 37a the key 
foi the T-2 matrix just constructed may be established It is 3-9-1-7-4-2-11 -8-10-6-5 
L Applying this method to the messages soh ed in paragraph 26d~e, the steps are as follows 
The width of the T-1 matnx has been established as being 12 The P-»C interval sequence in 
figure 366 shows the repetition -1-3-1-5—14—11—3 appearing two times, the repetition 
-|-3 -t-5 —14 appearing tliiee times, and the repetition —14—11 appearing three times The 
terms giving rise to tlu sc repetitions are arranged in a structure with ascending numbers within 
the columns Thus 

07 10 15 01 

27 13 02 

31 34 39 25 14 11 

43 46 51 37 26 23 

FiavBE 



05 




The constant diffeience, 12, indicates a T-1 matrix of 12 columns The matiix is piepaied 

1 2 1 4 a « 7 8 9 10 11 12 

01 02 03 04 05 06 07 08 09 10 11 12 

13 14 15 16 17 18 19 20 21 22 23 24 

25 26 27 28 29 30 31 32 33 34 35 30 

37 38 39 40 41 42 43 44 45 46 47 48 

49 50 51 

liriRF v>t 

The terms within the columns of the stiucturc in figure ibf aie tianscribed into rows (of the 
skeletonized T-2 matnx) 

07 31 43 

10 34 46 

15 27 39 51 

01 13 25 37 

02 14 26 

11 23 

llGVKE 36A(1) 

This structuie is extended by refernng to the T-1 niatiix (figure 36^1) 

1 2 3 4 5 6 7 

1 07 19 31 43 

2 10 22 14 46 

i 03 15 27 39 51 

4 01 13 25 37 49 

5 02 14 26 38 50 

6 11 23 35 47 

Figli e 366(2) 

Noting that the initial terms of the P->C sequence m figuic 36a (27 13 02) aie piesent m 

this structure (in the 3d column) this gives the top of the T-2 matnx as coinciding with the 3d 
row of the structure The P->C sequence in figure 36a reads 27 13 02 43 46 , the 

43 and 46 are also in the stnicture in figure 366 (2) in the 1st and 2d rows, column 5, hence the 
structure in figure 36hi2) can be rearranged thus 

OA 15 27 39 51 

01 13 25 37 49 

02 14 26 38 50 

07 19 31 43 11 23 35 47 

10 22 34 46 


FiruRE 366(3) 

now be extended by refeiimg to the P->C sequence in figure 36a 
35 03 15 27 39 51 05 17 

33 45 01 13 25 37 49 06 

24 36 48 02 14 26 38 50 

07 19 31 43 11 23 35 47 

10 22 34 46 

lirPBF 366(4) 


The structure may 






















Thus, by refernng alternately to the P->C sequence and the T-1 matrix the stiucture is extended 
to the following 


35 

03 

15 

27 

39 

51 1 05 

17 

29 

41 1 09 

21 33 1 

45 

1 

33 

45 1 01 

13 

25 

37 

49 1 06 

18 

30 

42 1 12 24 

36 

48 1 

24 

3b 

48 

1 02 

14 

26 

38 

50 

1 04 

16 

28 

40 i 07 

19 

31 43 

07 

19 

31 

43 1 11 

23 

35 

47 

1 08 

20 

32 

44 1 10 

22 

34 46 



34 

/U 










lU 


r“ 











Fiocre 3RA(S) 


It Will be noted that the first number to the light of each veitieal bar is one of the numbers from 
1 to 12, indicating that all the columns of the T-1 matrix are now represented in the T-2 structure 
It IS now easy to write the transposition key over the T-1 matrix 4-7-1-8-2-5-9-11-3-12-10-6 
By follow'mg the numbers m the P->C sequence the transposition key for the T-2 matrix is 
given directly, it is the same as for the T-1 matnx 

I (1) A third method for reconstiuctmg the transposition keys will now be set forth It 
will first be explained in connection with the artificial example in figure 37a It has been noted 
how the width of the T-1 matiix can be ascertained from a study of the P-^C sequence, the work 
in connection with figure 37o and subpaiagraph e give an indicated width of 8 for the T-1 matrix 
m this case 

(2) Let the additive 8 (found m subpais d and/) be applied to the entire P—»C sequence of 
figure 37a, and then let the identities between the two sequences be underscored and numbered, 
as showm in figure S7n 

(A) P^C sequence..{ 20 06 48 33 15 | 44 30 21 03 39 1 04 142 32 17 511 

36 22 13 49 31 | 34 24 091 43 1 26 16 01 351 

28 14 05 41 23|10 46 37 191 12 150 40 25 071 

7 8 9- 

18 08 45 27102 38 29 11 471 

10 11 

(B) P-»C sequence-l-8_j 28 14 56 41 23152 38 29 11 47| 121 50 40 25 591 

44 30 21 57 39 | 42 32 17 51 | 34 24 091 47 

4 fi a 

36 22 13 49 31 |18 54 45 27120 58 48 33 15 1 

7 8 9 

26 16 53 35110 46 37 19 551 

10 n ■ 

Figure a7fl 

If now the procedure explained in paragiaph 16^, 24c to/, and 25c to e is applied to the repetitions 
noted m figure Z7v, it becomes clear that the T-2 mati ix in this case must have 11 columns The 
transposition key for that matnx is then established, as follows * 


B . 1 2 3 4 5 6 7 8 9 10 11 

A . 7 11 9 2 3 5 4 10 1 6 8 

Cham. 1 74211 8 10 6539 


7 It IS to be noted that the B sequence (that is, the P—»C sequence plus the additnel must be used as the 
base, otherwise the chain of equI^alents will be a retirrwl of the correct chain 
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This IS a cyclic pennutation of the key for the T-2 matrix, to obtain the actual key it is necessary 
merely to fix the position of one of the kev numbcis with respect to the matrix It is easy to 
find which number belongs at the extreme left oi extreme right of the matnx Only a few 
mmutes expcrimentiition with the key and the T-2 matrix gives the conect staitiiig point for 
the key, which is found to be 3-9-1-7-4-2-11-8-10-6-5 

(3) The lecovciy of the transposition key for the T-1 matrix is now a simple matter Its 
width having been established as 8 columns, a meie transcription of the P->C sequence numbers 
fiom the T-2 matnx into the T-1 matnx gives the key 6-2-7-1-5-3-8-4 The two keys and 
matnees are found to be different 

(4) Tbo pioceduie set lorth in this subpaiagraph is applicable without modification to the 
case where the two tiansposition matrices are the same and have the same tiansposition key 
This will be noted m the foUownng demonstration of the recoveiy of the matnees and keys foi 
the messages solved m paragraph 26d and e by anagramming It has alieady been shown how 
the width of the T-1 matrix was ascertained as being 12 columns (subpar f) The additive 12 
is then applied to the cntiie P—>C sequence, identities are established between sections of the 
original sequence and sections of the sequence + 12, and these identical sections aie equated in 
the usual manner, leading to the establishment of a cyclic permutation of the transposition key 
foi tlic T-2 matrix Thus (fig 36^) 

_1_ 2 3 

A (P-»C sequence). 27 13 02 43 46 51 37 26 23 41 30 16 20 

B (P-»CBequence+12)- .. _ 39 25 14 55 58 63 49 38 35 53 42 28 32 

1 2 3 

_4_ 5 b 

03 45 3(i 19 22 05 49 38 35 33 21 07 10 

15 57 48 31 34 17 61 50 47 45 36 19 22 

4 5 6 

_7_ 8 9 

15 01 48 31 34 39 25 14 11 17 06 50 47 

27 13 60 43 46 51 37 26 23 29 18 62 59 

7 8 9 

10 11 12 
21 12 40 44 29 18 04 08 09 42 28 32 

33 24 52 56 41 30 16 20 21 54 40 44 

’ 10 11 12 
Fiqurf 381 


B . .. 1 2 3 4 5 6 7 8 9 10 11 12 

A. 8 5 12 7 9 4 1 2 11 6 3 10 

Cham. 1 8 2 5 9 11 3 12 10 6 4 7 


Since sections 1, 4, and 7 of the P-»C sequence contain 5 terms ( = long columns), the other 
sections only 4 ( = short columns), it follows that the key numbers 4-7-1 go to the left and the 
actual key for the T-2 matnx is 4-7-1-8-2-5-9-11-3-12-10-6 Since the number of elements 
in this key is the same as m the key for the T-1 matrix, it is likely that the same key is employed 
for both transpositions Simple experiment will quickly veiify this assumption and the trans¬ 
position matnees for the first of the 5 messages of paragraph 26d mav be seen in the following 
(figure 367 ) 



















m (1) A fouith and possibly the most elegant solution to the pioblem of reconstructing 
the keys foi double tiansposition will now be piesiu'ted ® Reference will be made to the two 
matrices and keys shown in figure 36j Let the P->C, and P-^Ca sequences resulting from the 
first and the second tianspositions, respectively, be shown, as scon below 

1 Term numbei. ... 

2 P-^Ci sequence.. 

P-»C 2 sequence.. 


02 

03 

04 

06 

06 

0( 

08 

09 

10 

11 

12 

13 


18 

16 

15 

27 

39 

51 

05 

17 

29 

41 

09 

21 

33 

45 

01 

13 

25 

13 

02 

43 

46 

51 

37 

26 

23 

41 

30 

16 

20 

03 

45 

36 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

80 

31 

32 

33 

06 

18 

30 

42 

12 

24 

36 

48 

02 

14 

26 

38 

50 

04 

16 

05 

49 

38 

35 

33 

24 

07 

10 

15 

01 

48 

31 

34 

39 

25 

36 

37 

38 

39 

40 

41 

42 

43 

44 

46 

40 

47 

48 

49 

50 

07 

19 

31 

43 

11 

23 

35 

47 

08 

20 

32 

44 

10 

22 

34 

17 

06 

50 

47 

21 

12 

40 

44 

29 

18 

04 

08 

09 

42 

28 


, ^ ’"8 this founh and most important method \i ere discovt red and first presented 

]fl34 by Solomon Kullback, Ph D , then Junior Crjptanalvst, SIS 


A casual examination of these tliiee rows of numbeis discloses an intciestmg invariant lelation- 
ship between any pair of superimposed numbers in lows 1 and 2 and in rows 2 and 3 Foi 
instance, take the veiy first pair, in lows 1 and 2, in low^s 2 and 3 the same pair of supei- 
imposed numbers will be found (under term No 14) This same relationship exists between all 
the siipenmposed pairs m rows 1-2 and 2-3 

(2) Given only the third row of numbers in figure 36t, that is, the P-»C 2 sequence (which 
has heretofore been designated merely as the P-»C sequenre), obtained as a icsiilt of a solution 
bv superimposing and anagrammmg several messages, it is not difficult to reconstruct the second 
low, the P-^Ci sequence The width of the T-1 matnx can be ascertained by eithei of the two 
methods indicated in subparagraphs e and f It is now known to be 12 A 12-column matrix 
IS therefore constructed, containing 51 colls numbered m the normal manner This will, of 
course, give the T-1 matnx seen m figure 36j, but without the transposition key oi the letters 
in the cells Thus 


i 3 4 5 « 7 3 9 10 11 13 


01 02 03 04 05 06 07 08 09 10 11 12 

13 14 15 16 17 18 19 20 21 22 23 24 

25 26 27 28 29 30 31 32 33 34 35 36 

37 38 39 40 41 42 43 44 45 46 47 48 

49 50 51 I- 

Fioubi3<< 

The mvanant lelationship pomted out in subparagraph (1) above may now be used to estab¬ 
lish the T-1 key Since the key is known to contain 12 elements, a start may be made with 
any one of 12 possibilities Suppose that the key begins with 1 The fiist five terms in the 
P->Ci sequence would be as indicated herewith 


1 Term number.. 

01 

02 

03 

04 06 

2 P->Ci sequence. 

01 

13 

25 

37 49 

3 P-»Cj sequence . 

27 

13 

02 

43 46 

Two “conflicts” 01 contradictions are at once manifested 

01 

01 

m lows 1 and 2, m rows 2 and 3, 


also, jg in rows 1 and 2, jg m lows 2 and 3 The conclusion is obvious that the key numbci 1 


does not occupy the 1st position in the transposition key Suppose key number 1 belongs in the 
2d position in the key The siipenmposed sequences are then as follows 


1 Term number. . oi 02 03 04 Oo 

2 P-»Ci sequence. 02 14 26 38 50 

3 P->C 2 sequence. 27 13 02 43 46 


Here agam two conflicts are noted Qg ™W8 1 and 2, q® low's 2 and 3, m lows 1 and 2, gy 
m rows 2 and 3 Only a smgle contradiction is sufficient to permit of discarding an hypothesis 
The key number 1 does not occupy the 2d position m the key A tnal is made of the 3d position 
for key number 1 The results aic as follows 


1 Term number. .. 

2 P-»Ci sequence_ 

3 P->C 2 sequence. ... 


.... 03 15 27 39 51 
.... 27 13 02 43 46 
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Hole tlu'ic aie no conttadictions and ono check oi coiroboration in lows 1 and 2, ^ m lows 
2 and If key numbei 1 leally occupies the 3d position in the key, then the siipenmposition 
data given in the last si't of loivs of superimposed numbeis mav be employed, by transfeinng the 
data to the piopci positions m the skeletonized figure 36m(l) 

1 Term number_ oi 02 03 04 os oe 07 os 09 10 11 12 is 14 is is 17 

2 P-^C, sequence—. 03 15 27 39 51 05 01 

3 P->C 2 sequence-. 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 19 

IS 19 20 21 22 23 24 25 26 27 2S 29 30 31 32 33 34 

02 04 

22 05 49 38 35 33 24 07 10 15 01 48 31 34 39 25 14 

35 36 37 3S 39 40 41 42 43 44 45 46 47 48 49 50 51 

11 17 06 50 47 21 12 40 44 29 18 04 08 09 42 28 32 

Figure 36m (1) 

It then becomes at once possible, by leferiing to the T-1 matiix, to inseit moie numbeis in the 
P-^Ci sequence Thus 

1 Teim number. oi 02 03 04 os os 07 os 09 10 11 12 la 14 is 16 i7 

2 P->Ci sequence-. 03 15 27 39 51 05 17 29 41 01 13 25 37 

3 P-^Cj sequence- 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 19 

18 19 20 21 22 23 24 25 26 27 28 29 30 81 32 33 84 

49 02 14 26 38 50 04 16 28 

22 05 49 38 35 33 24 07 10 15 01 48 31 34 39 25 14 

35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 60 51 

40 

11 17 06 50 47 21 12 40 44 29 18 04 08 09 42 28 32 

FirURE 36m (2) 

07 

Tlie new placements now permit of placing numbers in the P->Ci sequence For example, 
ui rows 1 and 2 permit of placing the number 07 above the numbei 17 m the P-^Cj sequence, ^8 
in rows 1 and 2 permit of placing the number 08 above the number 29 m the P-^Cs sequence, 
and so on In only a few moments the cntiie P-»Ci setiuence can be established Thus 

1 Term number ... oi 02 03 04 os oe 07 os 09 10 11 12 18 14 18 le 17 

2 P-^Ci sequence_ 03 15 27 39 51 05 17 29 41 09 21 33 45 01 13 25 37 

3 P-»C 2 sequence.... 27 13 02 43 46 51 37 26 23 41 30 16 20 03 45 36 19 

18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 

49 06 18 30 42 12 24 36 48 02 14 26 38 50 04 16 28 

22 05 49 38 35 33 24 07 10 15 01 48 31 34 39 25 14 

35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 

40 07 19 31 43 11 23 35 47 08 20 32 44 10 22 34 46 

11 17 06 50 47 21 12 40 44 29 18 04 08 09 42 28 32 

Figure 86n 

(3) The determination of the T-1 kev is now a a ery simple matter Since it is known that 
the key has 12 numbers, it is only necessary to note m the P->Ci sequence the relati\e order of 
the numbers 1 to 12 It is as lolhnvs 

1 2 3 4 5 6 7 8 9 10 11 12 


3 5 9 


6 12 2 4 7 11 8 10 
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This is merely the inviise of the actual key, the latter may be obtained by inveision Thus 

1 2 3 4 5 6 7 8 9 10 11 12 

4 7 1 8 2 5 9 11 3 12 10 6 

Comparison of this key with the T-1 key showm in figure 36j will establish the identity of the tw o 
The determination of the T-2 key is obvious, havmg the T-1 at hand In this c ase both matrices 
and keys are identical 

n Attention will be directed to a further interestmg phenomenon m this c ase Keferi irig to 
figure 36ft, if chains of equivalents are constructed between elements of the 1st and 3d loivs only, 
the following two chains arc obtained 

01 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28 

04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 

Figure 36o 


All the terms of the P-^C* sequence are represented, except the number 24, which stands by 
itself If now each of these chains is slid against itself, when pioperly juxtaposed, the super¬ 
imposed pairs are identical with those m rows 1 and 2 in figure 3671 Note the followmg 

. JOI 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28 

^^^l03 02 13 20 49 42 40 21 38 50 28 01 27 15 45 18 22 35 11 30 31 34 14 

. J04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 

^ ^1.39 47 08 26 10 41 12 16 36 17 19 05 46 04 43 44 29 48 09 23 33 25 07 37 06 51 32 

FlOURl 36P 

The application of the foregomg phenomena m the case under study is obvious Here it is not 
even necessary to ascertain the width of the T-1 matrix before proccedmg to try to establish 
the T-1 key Of course, the number of chains which may be established will vary with the 


6 2 7 1 5 3 8 4 


01 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 40 
41 42 43 44 45 46 47 48 
49 50 51 I- 

A (=T-1) 


8 9 1 7 4 2 11 8 10 6 5 


01 02 03 04 05 06 07 08 09 10 11 
12 13 14 15 16 17 18 19 20 21 22 
23 24 25 26 27 28 29 30 31 32 33 
34 35 36 37 38 39 40 41 42 43 44 
45 46 47 48 49 50 51 |- 


B 


3 9 1 7 4 2 11 8 10 6 5 


04 12 20 28 36 44 02 10 18 26 34 
42 50 06 14 22 30 38 46 08 16 24 
32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 
51 07 15 23 31 39 47 | - 



C (=T-2) 

Figure S7o 
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specific matrices and keys, but tlie general piinciples herein presented mav nevertheless be 
applied In some cases it may be necessary to juxtapose two different chains obtained by 
equating teiins fiom rows 1 and 3, rather than juxtaposing one chain against itself Only a 
few minutes expeiimentation will be necessary to establish contradictions which will permit of 
discarding fallacious liypotluscs 

0 (1) In the foicgomg explanation, the two tiansposition kiys and matrices were identical 
Even when tlii'y aie different the same principles, with minor modifications, may be applied 
The matrices and keys of figure 37a will again be employed to demonstrate the necessaiy modi¬ 
fications 

(2) Fust, pripaic the two inatiices with (onsecutiie numbers m the colls of both matnees, 
as shown at A and B in figure 37o and then prepaie the T-2 matrix shown at C 

(3) Write the P->Ci sequeme for T-1, under it wiite tin P->Ci for T-2, and undei 


1 the latter write the P^C 2 

sequence 

for the final crvptogram 

Thus 








1 Teiin numbei . .. .. 

. 01 

02 

03 

04 

03 

06 

07 

08 

09 

10 

11 

13 

13 


1 

2 P->Ci sequence foi T-1 

.. 04 

12 

20 

28 

36 

44 

02 

10 

18 

26 

34 

42 

50 

06 


3 P-^Ci sequence for T-2 

- ... 03 

14 

25 

36 

47 

06 

17 

28 

39 

50 

01 

12 

23 

34 


4 P->C 2 sequence . 

.... 20 

06 

48 

33 

15 

44 

30 

21 

03 

39 

04 

42 

32 

17 


13 

16 

17 

18 

19 

30 

21 

23 

23 

24 

25 

26 

27 

28 


14 

22 

30 

38 

46 

08 

16 

24 

32 

40 

48 

05 

13 

21 

1 


45 

05 

16 

27 

38 

49 

11 

22 

33 

44 

10 

21 

32 

43 

1 

1 

51 

36 

22 

13 

49 

31 

34 

24 

09 

43 

26 

16 

01 

35 

! 

i 

29 

30 

31 

32 

33 

34 

3a 

36 

37 

38 

39 

40 

41 

42 



29 

37 

45 

01 

09 

17 

25 

33 

41 

49 

03 

11 

19 

27 

1 


04 

15 

26 

37 

48 

08 

19 

30 

41 

02 

13 

24 

35 

46 

1 


28 

14 

05 

41 

23 

10 

46 

37 

19 

12 

50 

40 

25 

07 

1 


43 

44 

45 

46 

47 

48 

49 

aO 

51 








35 

43 

51 

07 

15 

23 

31 

39 

47 







1 

09 

20 

31 

42 

07 

18 

29 

40 

51 







1 

18 

08 

45 

27 

02 

38 

29 

11 

47 
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Note, now, the invariant relationship between rows 1-2 and 3-4 The same phenomenon is 
here manifested as was encountered in the preceding case where the T-1 and T-2 matrices and 
keys were identical It follows, therefore, that the principles elucidated under subparagraph m 
may be applied, with some modifications, also to the case where different keys and matrices are 
employed tor double transposition The width of the T -1 matiix may be ascertained m the 
manner alieady ii.dicated, an assumption is made as to the position occupied by key number 1 
of the T-1 key, this assumption piovidcs data foi making an assumption as to the width of the 
T-2 matiix When the correct pur of assumption' is made, the data in rows 1 and 2 are cor¬ 
roborated by those in rows 3 and 4 From that pomt on the rest is easy and follows along the 
same lines as before 

p (1) The procedure will be illustrated by employing the P-»C sequence in figure 376 
(which IS the same as that labelled P->Cj sequence in figure 37/i), it being assumed that nothmg 
IS known about the matrices, and tb it the sequence was obtained from a solution by superim¬ 
posing and anngrainming several messagi's of identical length 
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(2) The width of the T-1 matiix is established as 8 and the T-1 matiix set down 


ri&UE» Vq 

(3) Assuming that key numbei 1 occupies the first jiosition m the T-1 key, the numbers are 
uiserted m row 2, leprcsentmg the beginning of tbe P—>Ci sequence foi T-1 The superimposed 
pairs m rows 1 and 2 are distiibuted in rows 3 and 4, with tbe lesults shown in figure 37r(l) 


1 Term number. _ oi 02 03 04 os oe 07 os 09 10 11 12 13 14 

2 P-»Ci sequence for T-1 _ 01 09 17 25 33 41 49 

3 P-»Ci sequence for T-2- 05 03 

4 P->Ci sequence_ ..... 20 06 48 33 15 44 10 21 03 39 04 42 32 17 


15 16 17 18 19 20 21 22 23 24 25 26 27 28 

07 02 01 

51 3fa 22 13 49 31 34 24 09 43 2b 16 01 35 

29 30 31 32 33 34 33 36 37 3S 39 40 41 42 

06 04 

28 14 05 41 23 10 46 37 19 12 50 40 25 07 

43 44 43 46 47 48 49 50 51 


18 08 45 27 02 38 29 11 47 

FirUBE 17r (1) 

(4) An attempt is now made to constiuct a T-2 matrix winch will produce the distribution 
and spac ing of the numbeis in row 3 For example, from the position of the number 05 the matnx 
would have to be of such dimensions that there aie short columns of 2 letteis and long columns of 
3 letters, or short columns of 3 letters and long columns of 4 letteis The formei hypothesis 
can be discarded at once, for the intervals between the numbeis 03, 07, 02, 01, and 06 in row 3 
make it untenable The latter hypothesis may also be discarded, lor the inteivals between 03 
and 07 and between 01 and 06 make it impossible Hence key numbei 1 cannot occupy the fust 
position 111 the T-1 key Position 2 is assumed foi key number 1 and the procedure repeated, 
also without good lesults Note what happens when position 4 is ‘issumed for ki'y number 1 in 
the T-1 key 


1 2 3 4 8 6 7 8 

01 02 03 04 05 06 07 08 

09 10 11 12 13 14 15 16 

17 18 19 20 21 22 23 24 

25 26 27 28 29 30 31 32 

33 34 35 36 37 38 39 40 

41 42 43 44 45 46 47 48 

49 50 51 I- 

T-1 


I 


.i 
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09 10 11 12 13 14 

01 

03 39 04 42 32 17 

IS 1# 17 18 19 20 21 22 23 24 25 26 27 28 

05 

51 3b 22 13 49 31 34 24 09 43 2b lb 01 35 

2» 30 31 32 33 34 35 36 37 38 39 40 41 42 

04 02 

28 14 05 41 23 10 46 37 19 12 50 40 25 07 

43 44 45 48 47 48 49 50 51 


1 Term numbei— _ oi 02 03 04 os 06 

2 P-»Ci sequence lor T-1. 04 12 20 28 36 44 

3 P^Cj sequence for T-2 .. ... 03 06 

4 P-^C 2 sequence_ 20 06 48 33 15 44 


18 08 45 27 02 38 29 11 47 

Fiqubi 37r (2) 

(5) Heie there are found no contradictions of the nature of those pointed out above The 
T-2 matrix appeals to have columns of 4 and 5 letters, since the interval between 04 and 02 m 
row 3 can accommodate a short column of 4 and a long column of 5 letters, the mterval between 
05 and 04 can accommodate 2 short columns of 4 letters and 1 long column of 5, the mtervals 
between 03 and 06, 06 and 01, 01, and 05 can accommodate long columns of 5 letters each 
Only 2 matrices can be constiucted of 51 letters with long columns of 5 and shoit columns of 
4 letters They arc 


Key of 11 


f7 (long) X5=35 
[4 (short) X4= 16 51 


Key of 12. . 


f3 (long) X6=15 
1.9 (short) X4=36 51 


Each of these T-2 matrices is tested as a possibility 


^ ^ 4 5 8 7 8 9 10 11 1 2 3 4 5 6 7 8 19 10 11 12 


01 02 03 04 05 06 07 08 09 10 11 
12 13 14 15 16 17 18 19 10 21 22 
23 24 25 26 27 28 29 30 31 32 33 
34 35 3fa 37 38 39 40 41 42 43 44 


01 02 03 04 05 06 07 08 09 10 11 12 
13 14 15 16 17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 33 34 35 36 
37 38 39 40 41 42 43 44 45 46 47 48 

— ..1 1 



A B 


Fiocbk 37r (3) 

(6) If matrix A is coiiec t, then the numbers m columns 3, 6, 1, 5, 4, and 2 can be transferred 
to row 3 m figuie 37r (2), tliese will permit of inserting numbi'rs m low 2 No contradictions 
and many checks aie found Here is the diagram 
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Fiqvbk 37r (4) 

(7) In the fiist place note, in row 2, the constant diftercnco 8, giving many corroborations 
that the width of the T-1 matnx is 8, m the second place no conflicts whatevei become manifest 
between the pairs of rows Thus, the validity of the assumption of a T-2 matiix with 11 columns 
18 well established The icst follows quite readily, with the final result that figure 37r becomes 
completed, and the recovery of both keys is a simple matter In fact, both keys may be estab- 
hshed from a simple study of rows 2 and 3 of the final figuie (which would, of couise, be identical 
with that shown in fig 37p and need not heie be repeated) 

g A careful study and good giasp of the principles and methods elucidated iii this paragraph 
will be sufficient to indicate to the student that when, as a lesult of a close study of several 
messages m the same keys, partial C-»P sequences become available, the entire C-»P sequence 
or sequences can usually be reconstructed from the partial sequence or sequences and tlie mes¬ 
sages solved without too much difficulty For instance, suppose it has developed that the 
enemy has become addicted to stereotypic beginnings, so that the fiist few letters of a message 
or of several messages can be reconstructed with some assurance of certainty The construction 
of partial C—>P sequences and then completion by means of the prmciples set forth, especially 
those presented m subparagraphs m-p, may lesult in reconstruction of the complete C-^P 
sequences and ultimate recovery of the liansposition key or keys 

28 Special cases of solution of double transposition ciphers —a When the double trans¬ 
position system is employed m the field and is used for a volummous traffic it is almost mevitable 
that ceitam situations wiU arise which make possible a rather easy solution Aside from the case 
m which several cryptograms of identical length and m the same key are mtercepted, other cases 
of a special nature may arise Some of these wiU be discussed m this paragraph 

b First, there is the case m which an mexpeiienced cryptographic clerk fails to execute the 
double transposition properly and causes the transmission of a ciyptogram which is only a smgle 
transposition The solution of this message will be a simple matter and wdl, of course, yield the 
key If the key is the same for both tianspositions it is obvious that this will peimit the leading 
of all othei messages even though the lattoi have been coiiectly cryptogiaphed The only 
difficult part of the matter is to find among a large number of mtercepted ciyptogiams one which 
involves a blunder of this soit When the cryptanalyst has, as a lesiUt of considerable expen- 
ence, become adept m the solution of transposition cipheis the woik of testmg cryptograms to 
ascertain whethei oi not they involve smgle columnai tiansposition is not difficult and goes quite 
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lapidly Foi only a few minutes aic sufficient to give him the “feeling” that the cryptogiam is oi 
IS not solvable by smgle transposition He might not bo able to pomt out any specific mdications 
which give him this feelmg if asked to do so, neveitheless it must be recognized that his intuition 
IS alone sufficient to tell him when there is hope of solution along this line and when further woik 
upon the hypothesis of single tiansposition is useless 

c (1) Next comes the case m which the enciphering lectangles of a double transposition 
ciyptogram happen to be perfect squares (that is, both T-1 and T-2 rectangles are perfect 
squares) In this case, not only is such a cryptogram detectable at once, smee the total number of 
letters is the squate of the numbei of elements m the key, but also the cryptogiam can be solved 
m a veiy sunple manner For the cryptogram now represents a case m which a completely-filled 
rectangle has been employed, and moreover there is no need even to assume various widths 

(2) Given the following ciyptogram of 49 letters (7X7) as an example, the text is tran¬ 
scribed as shown in figuie 39a and letranscnbed as in figure 396 

Cryptogram . UCTRN OESHI ETOLR GASOE DUWDD 

NOEOE RDNDI RFENC OEEEM NNVE 

1 2 3 4 S 0 7 _1_2_3_^_5__6_7 2 6 1 5 3 7 4 2 6 1 5 3 7 4 

USRUORE UCTRNOE COUNTER HOSTILE 

CHGWEFE SHIETOL HOSTILE FORCEEN 

TIADREM RGASOED GEROADS COUNTER 

RESDDNN UWDDNOE WOUNDED EDONRID 

NTONNCN OERDNDI EDONRID GEROADS 

OOEODOV RFENCOE FORCEEN EVENMEN 

ELDEIEE EEMNNVE EVENMEN WOUNDED 

Fiouke 30(1 Figure 395 Figure 39c' Figure 39d 

(3) The columns of %ure 396 are now anagiammed, as m figure 39c, and the rows rearranged, 
as m figure 39d 

d When the encipheiing rectangle is not a perfect square but nevertheless a complete rec¬ 
tangle, solution of a smgle cryptogram becomes somewhat more diflBcult Here the columns are 
all equal m length, smee the last row of the rectangle is completely filled Two cases will be 
considered, fiist, when the width of the rectangle is a multiple of the depth, or number of letters 
in the column^, and second, when the depth is a multiple of tlie width 
e (1) Takmg up the first case, note the followmg encipherment 
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P-»C sequence. 
Cryptogram_ 
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33 3 6 


48 43 


34 39 40 35 37 14 19 20 la 17 32 36 31 38 

lONLESROQANLETVHIWLEGDIIH 


4 9 10 5 7 44 49 50 45 47 22 26 21 28 23 12 16 11 18 13 24 29 30 25 27 

NFIWLTSEAVRHNOESURDTALDCG 


If the P-»C sequence is exammed it will be found that sections thereof fall mto two cate¬ 
gories, as follows 


Seetbn 

1 1 — 4 9 10 5 7 

2 — 14 19 20 16 17 

3 — 24 29 30 25 27 

4 — 34 39 40 35 37 

5 — 44 49 60 45 47 


Category B.-.j 


'6—2 6 1 8 3 

7—12 16 11 18 13 

8 — 22 26 21 28 23 

9 — 32 36 31 38 33 

^10 — 42 46 41 48 43 


(2) There is obviously a definite regularity m the composition of the sections whereby, if the 
letters correspondmg to the numbers m one section can be assembled properly, all the letters 
correspondmg to the numbers m the other sections helongmg to the same category (A or B, 
respectively) will be assembled correctly too For example, m category B the letters correspond¬ 
mg to the numbers occupymg the third, first, and fifth positions m each section are sequent m 
the plam-tcxt rectangle, m category A the letters correspondmg to the numbers occupymg the 
first and fourth positions m each section are sequent Moreover, aU the letters m each section 
come from the same row m the T—1 rectangle Consequently, if two sections commg from the 
same row can be identified, there wdl be 10 letters which may be rearranged by experiment to 
form plam text, and the key for this rearrangement will apply to all other pairs of sections 
For example, the message m this case has a Q and only one U The Q (P->C sequence No 
15) IS m the second section, the U (P—>C sequence No 16) is m the seventh section These two 
sections come from the same row and the letters may be anagrammed * 


1 2 3 4 5 6 7 8 9 10 

SROQA and SURDT 
2 16 8 
°8 °6^ 10 ? 4 7 5 9 2 3 

RSTSQUADRO 


Experiment may now be made with two other sections, applymg the same transposition Thus 

1 2 3 4 5 6 7 8 9 10 

lONLE and NLETV 


°8^ “o 10 i 7 5 9 °2 3 

0 I N E 

ENVILLETON 

Obviously the proper key for rearrangement is 8-6-10-1-4-7-5-9-2-3 By contmumg this 
procedure the following additional lows of the T-1 rectangle are reconstructed 

1 2 3 4 5 6 7 8 9 10 8 6 10 1 4 ’ 1 « » 3 


N F I W L 

and 

H I W 

L 

E 

yields... 

...W H E N W 

I L L F I 

T S E A V 

and 

GDI 

I 

H 

yields_ 

...I G H T A 

D V I S E 

A L D C G 

and 

R H N 

0 

E 

yields_ 

...N R E A C 

H G 0 L D 


• The fact that the length of the sections coi responds to 5-letter groups has, of course, no bearing on the 
validity of the method In this case it just happens that the rectangle contains 6 letters per column 
324166—41-6 















The various rows are now assembled m sequence, giving the following 
WHENWILLFI 
RSTSQUADRO 
NREACHGOLD 
ENVILLETON 
IGHTADVISE 

The transposition key can now be reconstructed with ease 

(3) The cryptanalyst m this case must, of course, make an assumption as to the width of 
the enciphermg rectangle before he can apply the method With a number such as 50, the 
dimensions 10X6 or 5X10 suggest themselves The process of findmg cipher groups which 
form pairs on the same row is one of “cut and try ” If there is a smgle Q and a smgle U m the 
message, the initial pair of groups is obvious 

/ 'li^en the depth of the rectangle is a multiple of the width, solution follows along the 
Imes of the precedmg case Takmg the same message as before, note what happens m enci¬ 
pherment with a rectangle of 5 columns containing 10 letters each 

25143 25143 



P-»C sequence_ is as ii as is « u 39 la 37 s ss i a« # so 4 29 a 27 ss 48 21 « ss » 24 49 22 47 

Cryptogram.T TRLQNSOSEEOWHWDNLHGEINDCEASRV 

18 43 16 41 20 45 19 44 17 42 8 83 6 31 10 as 9 34 7 32 

DHUIOARTAGLVIEILFILN 

Takmg the numbeis of the P->C sequence and anangmg them m sections of 10, the results 
are as follows 
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It IS obvious that if the 3d, 9th, 1st, 7th, and 6th columns are made sequent, good text will be 
produced withm the 5 rows Thus 


123456789 10| 


[39175 

TTRLQNSOSE 


R S T S Q 

eowhwdnlhgI 


W H E N W 

EINDCEASRV 


N R E A C 

DHUIOARTAG 


U A D R 0 

lvieilfilnJ 


I L L F I 


The subsequent steps are obvious Here agam m solvmg an unknown example it would be 
necessary to test out various assumptions with respect to the dimensions of the rectangle before 
attemptmg to apply the method outlmed 

g Whenever this simple relationship between the width and depth of the rectangle obtams, 
that is, when one dimension is a multiple of the other, solution of a smgle ciyptogram is relatively 
easy The reason for this is not hard to see When the enciphermg rectangle is a perfect square, 
every column of the T-2 rectangle is composed of letters which all come from the same row of 
the T-1 rectangle Hence solution is m this case the same as though a false double transposition 
were m effect, with merely the columns and the rows of a smgle rectangle shifted about When the 
width of the transposition rectangle is twice the depth, a column of the T-2 rectangle contams 
bn.1f the letters appearmg on one row of the T-1 rectangle, two columns therefore contam all the 
letters belongmg m the same row of the T-1 rectangle If the width were three tunes the depth, 
then three columns of the T-2 rectangle would contam all the letters belongmg m the same row 
of the T-1 rectangle, and so on When the width is half the depth, a column of the T-2 rectangle 
contams all the letters appearmg m two rows of the T-1 rectangle, when the width is one-third 
the depth, a column of the T-2 rectangle contams all the letters appearmg m three rows of the 
T-1 rectangle, and so on But when this multiple relationship no longer obtams, solution becomes 
more difficult because each column of the T-2 rectangle is composed of letters commg from sev¬ 
eral columns of the T-1 rectangle, m an irregular distribution Solution is, of course, most diffi¬ 
cult when mcompletely filled rectangles are used However, although solvable, even m the case 
of a smgle message, the solution will not be dealt with m this text 








Section VI 


PRINCIPLES OF MATRIX RECONSTRUCTION 

Paragraph 

Special designs or geonittric figures. ... . ... .29 

Reconstruction of transposition matrix . . . ... .30 

29 Special designs or geometric figures —a It is impossible hero to elucidate and demon¬ 
strate by example all the methods which may be used for the solution of cryptograms produced 
by the many various types of transposition designs or geometiic figures other than the simple 
rectangular ones thus far treated Reference may be made to such matrices as triangles, trape¬ 
zoids, and polygons of various symmetiical shapes Most of these matrices, however, are imprac¬ 
tical for military correspondence m any case, so that no attention need be given them m this text 

b If such designs were used, although it might be difllcult to solve a single or even a few 
messages m the same key, the general solution described m paragraph 26 is applicable whenever 
two or more messages of identical lengths but in the same key are available for study Smee 
most of these designs are of a fixed or mflcxible character with regard to the number of letters 
that can be accommodated with one application of the design to the plam text to be enciphered, 
the production of several cryptograms of identical length in the same key is by no means an un¬ 
usual circumstance The general solution can usually be depended upon to yield the answer to 
cryptograms of this category but it then becomes advisable to try to ascertam the exact nature of 
the specific design or geometric figure employed, that is, to reconstruct the transposition matrix 
For this purpose a general method will be indicated by means of a specific example, Icavmg other 
cases to the mgenuity of the student after he has learned the general method 

30 Reconstruction of transposition matrix —a Assume that the enemy is employmg an 
unknown geometnc %uro of rather small dimensions so that it appears from a study of the traffic 
that it accommodates a maximum of 85 letters A long cryptogram has been mtercepted and it is 
broken up mto sections of 85 letters, which sections are then supenmposed, as shown below 
It wiU be noted that there are 3 complete sections of 85 letters each, plus a fihal section of but 
49 letters The final section will be dealt with later 
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81 


b The anagrammmg process is applied to the superimposed complete sections, namg the 
letter J m the first section as a startmg pomt and building up text on either side, until the follow¬ 
ing partially reconstructed text is obtained 

40 34 46 85 2 61 20 28 53 10 69 79 41 85 46 84 3 62 21 29 54 11 

ACHEDROADJUNCTIONFIVEF 
TEFARMXSECONDBATTALION 
BATTALIONTOVICINITYOFH 
c Examining the numbers foiming this partial C-^P sequence, note the followmg sections 
of the sequence 

40 34 45 85 2 61 20 28 53 10 

41 35 46 84 3 62 21 29 54 11 

They show a quite definite relationship, leading to the suspicion that the C-»P sequence is 
systematic in its composition The numbers arc then written down on cross-section paper so that 
consecutive numbers appeal on the same level, as shown m figure 40-A 
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Fiuuax 40-A 


d From this skeleton of what may be termed the matrw-reconstructwn dvagram it is possible 
to derive direct clues for the continuance and completion of the C->P sequence and the text of 
the message For example, it would appear that the very next column to the left should be 78, 
the one to the left of 78 should be 68, the one to the left of 68 should be 9 Trial gives the 
followmg 

9 68 78 40 34 46 88 2 

BREACHED 

FTATEFAR 

OURBATTA 

To the right of column 11 should come columns 70 80 42 36 47 Thus 

29 64 11 70 80 42 36 47 

VEFIVESE .. 
lONTHIRD. 

OFHARMON 


t- 

L 
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This, of course, speeds up the work involved m the anagrammmg piocess and when completed the 
text, the C->P sequence, the P->C sequence, and the matrix reconstruction diagram are as 
shown m figure 40-B In the cells of the diagram there have been mserted m the upper left 
hand comer small numbers m italics, the latter numbers bemg meiely the term numbeis 
applying to the C->P sequence 

e The matrix-reconstruction diagram m figure 40-B shows a total of 7 levels of numbeis 
Let the term numbers corresponding to the consecvixve, C-»P sequence numbers on the 
same level m the diagram be set down Thus, for the C->P sequence numbers 4 to 16, mclusive, 
on the first level the term numbers are 

C^P sequence number_ 4 5 6 7 8 9 10 11 12 13 14 15 16 

Term number_ 1 3 7 13 21 31 43 55 65 73 79 83 85 

On the second level there are two sets of consecutive C->P sequence numbers, those from 48 
to 58, mclusive formmg one set, those from 64 to 74, mclusive formmg the other set Two senes 
of term numbers are therefore denved 

C—>P sequence number_ 48 49 50 51 52 53 54 55 56 57 58 

Term number__ 2 6 12 20 30 42 54 64 72 78 82 


C-^P sequence number. 64 65 66 67 68 69 70 71 72 73 74 

Term number.—. 4 8 14 22 32 44 56 66 74 80 84 

What has been said of the 2d level apphes also to the remammg levels, and the term numbers 
are therefore set down m the foUowmg tabular form 
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C-»P sequence 
numbers to which 


10 11 12 13 applicable 

65 73 79 83 85 (4-16) 

72 78 82 (48-58) 

74 80 84 (64-74) 

77 (24-32) 

81 (75-83) 


(17-23) 

(38-44) 

(59-63) 

(33-37) 

(1-3) 

(45-^7) 

( 86 ) 

(84) 


Fiouke 41. 


j There are m all 13 sets or series of consecutive C->P sequence numbers, mdicatmg 
that the transposition matrix has 13 columns, the number of letters m each column corresponding 
with the number of different terms m each senes Thus, there is a column of 13 letters, 2 
columns of 11 letters, 2 columns of 9 letters, and so on This leads directly to the idea of a 
veiy symmetncal matrix of the form shown m figure 42-A 
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g. The recovery of the transposition key (for the columns of figure 42-A) is now a simple 
matter. Referring to the P^C sequence shown in figure 40-B, and noting the various columns 
in figure 42-A in which successive numbers of the P-^C sequence fall, the key number 1 of the 
transposition key obviously applies to the column containii^ P->C sequence numbers 26-38-50; 
the key number 2 obviously applies to the column containing P-»C sequence numbers 1-3-7-13- 
21-31-43-65-65-73-79-83-85; and so on. The complete transposition key and the matrix are 
shown in figure 42-B. 
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13 1 9 3 4 8 2 10 ■ 11 6 5 7 12 



h. The solution of the incomplete section of the message (the last 79 letters) now becomes a 
simple matter, since the matrix and the transposition key are both known. The matter can be 
handled as if simple transposition were involved, by outlining the matrix to contain exactly 79 
letters and inscribing the cipher text in the columns in key-number order. 

i. The foregoing principles and procedure will be found quite valuable not only in facili¬ 
tating the anagramming of the text in its initial stages (as in subparagraph d) but also in recon¬ 
structing various types of matrices based upon symmetrical designs used with single transpo¬ 
sition (subparagraphs e-g). It should be noted that the number of levels in the reconstruction 
diagram corresponds with the number of different-length colunms in the matrix; the number of 
different categories of term numbers (as in figure 41) corresponds with the number of columns 
in the matrix. 



Section VII 

SOLUTION OF GRILLES 

Paragraph 


Revolving grilles................. 31 

Solution of example...-...-.-... 32 

Concluding remarks on the solution of revolving grilles.... 33 

Indefinite or continuous grilles....... 34 


31. Revolving grilles.— a. In this type of grille ‘ apertures are distributed among the cells 
of a square sheet of cross-section paper in such a manner that when the grille is placed upon a 
grid (a sheet of cross-section paper of the same size as the grille) certain cells of the grid are dis¬ 
closed; then when the grille is turned three times successively through angles of 90° from an 
initial position upon the grid, all the remaining undisclosed grid cells (or all but the central 
grid cell) are disclosed in turn. Correspondents must, of course, possess identical grilles and they 
must have an understanding as to its initial position and direction of rotation, clockwise or 
counterclockwise. There are two procedures possible in using such a grille. (1) The letters of 
the plain text may be inscribed successively in the grid cells through the apertures of the grille; 
when the grid has been completely filled the grille is removed and the letters transcribed from 
the grid according to a prearranged route. (2) All the letters of the plain text may first be 
inscribed in the grid cells according to a prearranged route and then the grille applied to the 
completely-filled grid to give the sequence of letters forming the cryptogram. The two methods 
of using the grille arc reciprocal; if the first-described method is used to encipher a message, the 
second is used to decipher the cryptogram, and vice versa. The first of the two above-described 
methods, the one in which tbe plain text is inscribed through the apertures, wfil here be referred 
to as the alpha method; the second method will be referred to as the beta method. 

b. The number of letters in a cryptogram enciphered by such a device is either a perfect 
square, when the grille has an even number of cells per side, or is 1 less than a perfect square, 
when the grille has an odd number of cells per side, in which case the central cell of the grid is 
not disclosed and hence remains unfilled 

c. The manner of construction and the method of use of a grille entails certain consequences 
which can be employed to solve the cryptograms and to reconstruct the grille itself. The student 
who wishes to get a thorough grasp of the underlying principles to be explained will do well to 
prepare a grille ® and study the properties which characterize cryptograms produced by its use. 
Three principles wfil be brought to bear in the solution of grille ciphers of this type and they 
will be demonstrated by reference to the grille and message shown in figure 43. 

‘ See Special Text No. 166, Advanced Military Cryptography, sec. V. 

* Of course, the cryptogram may consist of the letters produced by several applications of the same grille. 
For example, if a message of 170 letters is to be enciphered by a grille accommodating only 36 letters at a time, 
the message is divided up into 5 sections of 36 letters each (10 nulls being added to make the total a multiple of 
36). The total number of letters (180) here shows no properties of the type noted. Again, if the grille has a 
capacity greater than the number of letters to be enciphered, certain of the grid cells may be cancelled, so that 
the number of letters in the final cryptogram wiU not be a perfect square or 1 less than a perfect square. 

' Detailed instructions for the construction of revolving grilles will be found in Special Text No. 166, Ad¬ 
vanced MUUary Cryptography, sec. V. 
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d. The first principle may be termed that of symmetry. When a reTolving grille is in position 
1 a certain number of colls of the underljnng grid are disclosed (uncovered). For each such 
disclosed cell of the grid there is a symmetrically-corcesponding cell on the same grid which is 
disclosed when the grille is turned to positions 2, 3, and 4, because the apertures of the grille 
remain fixed—only their positions change as the grille is tinned in the process of encipherment. 
Now two eaeeeeswe apertures in position 1 will, of course, be occupied by a plain-text digraph {alpha 
method of encipherment). When the grille reaches position 3, after a turn of 180°, the two 
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i apertures concerned will disclose two cells which will also be occupied by a plain-text digraph, 

I but the letters composing the digraph will be in reverse order in the plain text. TUs property is true 

also of two sveeessive apertures in position 2 when they turn up in position 4. Let the student 
i i verify this by moans of the grille which he has constructed. Thus, referring to %ure 43, at A 

I is diiown the grille in position 1. In the first row are shown 2 apertures, at coordinates 1-^ and 

1-3. At B are sliown the results of the first application of the grille to the grid. Note the letters 
I Y 0 (first 2 letters of message) in cells 4 and 8. Now note that the symmetrically-corresponding 

I cells disclosed when the grille is in position 3 are cells 57 and 01 and these correspond to cells 4 

; and 8 in the reverse order. The letter T in coll 57 therefore symmetrically corresponds with 

letter 0 in cell 8; the letter Y in cell 61 corresponds witli letter Y in cell 4. The same is true of all 
other letters in positions 1 and 3. As a consequence of this property of giillcs, a single cryptogram 
can be handled as though it were really two cryptograms of identical length having certain 
characteristics by means of which on assumption made in one te.xt may be verified by wliat it 
yields in the other text. That is, when the cryptogram is transcribed as a series of letters in one 
I line and the same text is written in another lino under these letters but in reversed order, then the 

superimposed letters wiU bear the symmetrical relationship pointed out in this paragraph. If 
j two letters in the upper line of such a transcription are taken to form a digraph, tlie two corre¬ 

sponding hitters in the lower line must form a digra])h but in reversed order in the plain text. 
For example, if the ciyptogram of figure 43 is written out as explained above, the result is as 
shown at figure 44. Now the presence of the Q in position 39 suggests that it be combined with 

I 1 2 S 4 5 6 7 8 9 10 11 12 13 14 U 18 17 18 U 20 21 23 23 24 26 28 27 28 28 so SI 32 

I OOMYUCHOMUELARNLFHAIRLNERIDNPGEO 

SETYYBCTUSSIOERHTTUOTUCSEQEEHTST 

33 34 36 38 37 38 39 40 41 42 43 44 46 40 47 48 48 60 61 63 88 64 65 68 87 68 so 80 81 82 83 84 

TSTHEEQESCUTOUTTHREOISSUTCBYYTES 

OEGPNDIRENLRIAHFLNRALEUMOHCUYHOO 

Fiouu 44. 

a U. If the U in position 43 is taken, then the symmetrical digraph corresponding to Q U would 
be L I; if the U in position 56 is taken, the symmetrically-corresponding d^raph would be H I. 
Furthermore, two apertures which are in the same column and which do not have an intervening 
aperture between them, will yield a good digraph in all 4 positions of the grille. For example, note 
apertures 2-6 and 3-6 at A in figure 43. When the grille is turned to positions 2,3, and 4 they will 
disclose two sequent letters in each case. An analysis of the symmetries produced by an 8X8 
grille yields the following table, which allows what cells are disclosed in the otlicr 3 positions when 
I an aperture is cut in any one cell in 1 of the 4 positions of tlic grille. For example, an aperture 

cut in cell 11 (position 1) will disclose grid-cell 23 when the grille takes position 2, grid-cell 54 when 
the grille takes position 3, and grid-cell 42 when the grille takes position 4. 

i Poritlana; 1-3 2-4 1-3 2-4 1-3 2-4 1-3 2-4 

I 1 8 5 25 11 23 19 22 

I 64 57 60 40 54 42 46 43 

i 2 16 6 17 12 31 20 30 

! 63 49 59 48 53 34 45 35 

; 3 24 7 9 13 26 21 27 

1: 62 41 58 56 52 39 44 38 

I 4 32 10 15 14 18 28 29 

61 33 55 50 51 47 37 36 

I Floun 46. 
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The second principle may be termed that of eawlusion. On account of the system upon which 
the construction of a revolving grille is based, a knowledge of the location of an aperture in one 
of the bonds brings with it a knowledge of 3 other locations in which there can be no apertures. 
For example, referring to A in figure 43, the presence of the aperture at coordinates 1-4 precludes 
the presence of apertures at coordinates 4-8, 8-5, and 5-1. By virtue of this principle of exclu¬ 
sion, the number of possibilities for choice of letters in solving a cryptogram prepared by means 
of a revolving grille becomes much reduced and the problem is correspondingly simplified, as 
wiU be seen presently. 

y. The third principle may be termed that of seguenee. When trymg to build up text, the 
letters which foUow a given sequence of plain-text letters will usually be found to the right and 
below, that is, if the normal method of writing was used (loft to right and from the top down¬ 
ward). For example, referring to figure 44, if the trig;raph Q U E is to be built up, neither the U 
in position 5 nor the U in position 10 is very likely to be the one that follows the Q; the U in position 
43 is the most likely candidate because it is the first one beyond the Q. Suppose the U in position 
43 is selected. Then the E for Q U E cannot be the one in position 40, or in any position in front 
of 48, since the E must be beyond the U in the diagram. 

g. In solving a grille, it will be found advisable to prepare a pieee of cross-section paper of 
proper size for the grille and to cut each aperture as soon as its location in the grille becomes 
quite definite. In this way not only will the problem be simplified but also when completed the 
proper grille is at hand. 

32. Solution of example.—o. Suppose the cryptogram sliown in figure 43 is to be solved. It 
has 64 letters, suggesting a grille 8X8. The cryptogram is first transcribed into a square 8X8, 
yielding what has already been obtained at F in figure 43. The Q in position 39 suggests that it 
is part of a word inscribed when the grille was in position 3, since there will be 16 plain-text letters 
inscribed at cadi position of the grille. Then a piece of cross-section paper is prepared for 
Trm.1tiTi g the grille as shown in figure 45-A, and on aperture is cut in the proper position to dis- 
dose, in position 3, cell 39. It will be found that this is the aperture located at coordinates 4-2 
of the grille shown in figure 45-A. At the same time the other 3 cells numbered 4 in the second 

12846878 12846878 
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band of the grille are marked so that they cannot become apertures. The result is shown in 
figure 45-B. Conforming to the principle of sequence, the U to be combined with the Q is 
sought to the right of the Q in figure 43-F. There are three candidates, in positions 43, 46, and 
56. Theyyidd: 
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fOrllle In position 3) 

39 « 39 46 3H S8 

Q U Q U Q U 

I L{=L Ip) I A(=A Ip) I M(=M Ip) 

All of the symmetrical correspondents of these 3 Q U’s are good digraphs and it is impossible to 
eliminate any of the three possibilities. The U in position 43 would place an aperture at coordi¬ 
nates 6-3 in figure 45-B; the U in position 46 would place an aperture at coordinates 6-6; and the 
U in position 56 would place an aperture at coordinates 7-8. All of these are possible, none being 
excluded by principle 2. Suppose the Q U is followed by E. There are only two possibilities: 
an E in cell 51 and E in cell 63. The following possibilities are presented: 

39 43 51 39 43 63 39 46 61 39 48 63 39 56 63 

QUE QUE QUE QUE QUE 

ILR ILO lAR lAO IMO 

(=R L I) (=0 L I) (=R A I) (=0' A I) (=0 M I) 

None of the symmetrical correspondents of the Q U E’s are impossible sequences in plain text, 
although 0 A I is not as probable as the others. (The 0 could be the end of a word, the AI 
the beginning of the word AID, AIM, AIR, etc.) Each of these possibilities would be tested by 
principle 2 to see if any conflicts would arise as to the positions of apertures. As in all cases of 
transposition ciphers, the most difficult part of the solution is that of forcing an entering wedge 
into the structure and getting a good start; when this has been done the rest is easy. Note what 
the results are when the proper apertures are assumed for QUEST in this case, as shown in fig;ure 
45—C. In position 1 this yields OUR LI . . .; in position 2 it yields two digraphs AN and UT; 
in position 4 it yields two digraphs H A and R 0. The student should note that the indicated 
digraphs A N and R 0 in positions 2 and 4, respectively, are certain despite the fact that there is 
a space between the two apertures disclosing these letters, for the principle of exclusion has per¬ 
mitted the crossing off of this cell as a possibility for an aperture. 



Fkicke 46-C. 
(Urille in position 3) 


b. Enough has been shown of the procedure to make further demonstration unnecessary. 
Given the sequence OUR LI one begins to build on that, assuming a word such as LINE. This 
yields possibilities for the placement of additional apertures in the grille; these are tested in 
positions 2, 3, 4, and so on. When any 16 consecutive letters of plain text have been established 
all apertures have been ascertained and the problem has been completed. Subsequent crypto¬ 
grams prepared by the same grille can be read at once. 
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c. If attempts at solution on the basis of the alpha method of using a grille have failed, the 
obvious modifications in procedure on the basis of the beta method can readily be made. 

33. Concluding remarks on the solution of revolving grilles.— a. There is nothing about the 
mechanics of revolving grilles which prevents their employment in enciphering complete words 
instead of individual letters. However, the assembling of whole words in intelligible sequences 
and thus the reconstruction of the original plain text is a much easier matter than assembling 
single letters to form the words of the original plain text 

b. In case the same grille has been employed several times with separate grids to encipher a 
message that is considerably longer than a single grid will accommodate (see footnote 2, par. 316), 
the several sections each representing the set of letters enciphered on one grid may be super¬ 
imposed and the general solution described in paragraph 26 may then be applied. 

c. In case the capacity of a grille is in excess of the number required by the length of the 
text to be enciphered, either of two procedures may be agreed upon. The grid cells which would 
otherwise be unoccupied may be filled by nulls, or the grid may be left incomplete. As regards 
the former procedure, little more need be said than that the presence of a few nulls will only 
delay solution a bit until the fact that nulls are being employed for this purpose becomes estab¬ 
lished. But the second type of procedure calls for more comment. If the grid is to be left 
incomplete it is necessary, before applying the grille, to count the number of plain-text letters 
and to cancel from the grid a number of cells equal to the number of cells in excess of the 
total number required. The position of tlie cells to be cancelled must be agreed upon: commonly, 
they are those at the end of the grid. Such cells are marked so that when they become exposed 
during the rotations of the grille they will not be used. Thus, for example, the grille shown in 
figure 43-A is intended for a grid of 64 letters; if the message to be enciphered contains only 53 
letters, 12 cells of the grid must be canceled, and by agreement they may be cells 53 to 64, inclusive. 
The solution of a single cryptogram of this sort, or even of several of them of different lengths, 
may become a ratlier diflicult matter. First of all, clues as to the dimensions of the grille are no 
longer afforded by the total number of letters in the cryptogram, so that this information can 
be obtained only by more or less laborious experimentation. Grilles of various dimensions must 
be assumed, one after the other, until the correct dimensions have been foimd. In the second 
place, the symmetrical relationships pointed out in paragraph 31 no longer obtain, so that a 
single cryptogram cannot be handled as though it were constituted of two messages of identical 
length. Of course, in trying out any assumed dimensions, the 64 letters of the cryptogram may 
be written out in two superimposed lines, blanks being left for those positions which are unfilled. 
The procedure then follows the normal lines. About the most hopeful clues would be obtained 
from a knowledge of the circumstances surrounding the transmission and affording a basis for 
the assumption of probable words. However, were such a system employed for regular com¬ 
munication there would undoubtedly be cases of cryptograms of identical lengths, so that the 
type of solution given in paragraph 26 will be applicable. Once a solution of this sort has been 
obtained, the dimensions of the grille may be ascertained. Subsequent cryptograms may then 
be attacked on the basis of the normal procedure, with such modifications as are indicated by 
the absence of the number of letters needed to make a completely-filled grid. 

34. Indefinite or continuous grilles.— a. In his Manual of Cryptography, Sacco illustrates 
a type of grille which he has devised and which has elements of practical importance. An ex¬ 
ample of such a grille is shown in figure 46. This grille contains 20 columns of cells, and each 
column contains 5 apertures distributed at random in the column. There are therefore 100 
apertures in all, and this is the maximum number of letters which may be enciphered in one posi¬ 
tion of the grille. The plain text is inscribed vertically, from left to right, using only as many 
columns as may be necessary to inscribe the complete message. A 25-letter message would require 
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but 5 colunms. To form the cryptogram the letteis are transcribed horizontally from the rows, 
taking the letters from left to right as they appear in the apertures. If the total number of 
letters is not a multiple of 5, sufficient nulls arc added to make it so. In decryptographing, the 
total number of letters is divided by 5, this giving the number of columns employed. The cipher 
text is inscribed from left to right and top downwards in the apertures in the rows of the indicated 
number of columns and the plain text then reappears in the apertures in the columns, reading 
downward and from left to right. (It is, of course, not essential that nulls be added in encipher¬ 
ment to make the length of the cryptogram an exact multiple of 5, for the matter can readily 
be handled even if this is not done. In docipheiment the total number of letters divided by 6 


[BieiEioiiaEaHiiaEiBafB 


'P- 

WA 

V//:\ 

Vj/J. 


mm 


my/y/Mmmmim 

WAmccimy^rmAWi 

wimyimmmm 

m 

VM. 

m 

s 

V/tk 

vm 

VM 

IkS 

wim\ 

vjim 

wmmmw/mL 

vm////my::mwMm. 

wmmjymJiMm 

VM 

B 

W/a 

WA 

mh 

■■11 

W/MA 

mM 

mmm. 

wdivKim/mm 

m.mmmmmi 

mmmmmwBM 

mimmmwkmmi 

WMimmmmwi 

■ 

W/L 

mL 

vm 


li 

ii 

mm 

VAAm/i 

ii 

li 

Ii 

11 

ii 

ymmmyy/m/myM 

m 

m. 

mi 


FIQURB 46. 


will give the number of complete colunms; the re mainder loft over from the division will give 
the number of cells occupied by letters in the last column on the right.) 

h. Such a grille can assume 4 positions, two obverse and two reverse. Arrangements must 
be made in advance as to the sequence in which the various positions will be employed. 

c. The solution of a single cryptogram enciphered by one and only one position of such a 
grille presents a practically hopeless problem, for the apertures being distributed at random 
throughout the grille there is nothing which may be seized upon as a guide to the reconstruction 
of either the grille or the plain text. It is conceivable, of course, that a person with an infinite 
amount of patience could produce an intelligible text and a grille conformable to that text, the 
grille having a definite number of columns and a fixed number of apertures distributed at random 
throughout the columns. But there would be no way of proving that the plain text so obtained 
is the actual plain text that was enciphered; for it would be possible to produce several “solutions” 
of the same character, any one of which might be correct.^ 

d. However, suppose a grille of this sort were employed to encipher a long message, requiring 
two or more applications of the grille. For example, in the case of the grille shown in figure 46, 
having a capacity of 100 letters per application, suppose a message of 400 letters were to be 
enciphered, requiring two obverse and two reverse applications of the grille. It is obvious that 
symmetrical relationships of the nature of those pointed out in paragraph 31 can be established. 
Of course, if the grille is used several times in the same position to its full capacity, producing 
cryptograms of multiples of 100 letters, then the seetions of 100 letters may be superimposed and 
the general solution elucidated in paragraph 26 applied. 

^ In this connection, see Military Cryptanalysis, Part IIT, sec. XI, footnote 8. 


e. If the grille shown in figure 46 were used to encipher two messages, one of 80 letters, the 
other of 85, it would be possible to solve these messages. For by eliminating 5 letters from the 
longer message, the two cryptograms can be superimposed and handled as in paragraph 26. The 
difficulty would be in finding the 5 extra letters. Of course, if it should happen that one of the 
messages required 3 or 4 nulls and letters such as J, X, or Z were employed for this purpose, the 
nulls would be likely characters for elimination. But regardless of this, even if letters of medium 
or high frequency were used as nuUs, patient experimentation would ultimately lead to solution. 
The latter, it must be conceded, would be difficult but not impossible. 
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Section VIII 

COMBINED SUBSTITUTION-TRANSPOSITION SYSTEMS 


Paragraph 

Reasons for combining transposition with substitution . 35 

Other types of combined substitution-transposition b\ stems. 36 

35. Reasons for combining transposition with substitution.—a. Transposition methods are, 
from the cryptographic point of view, rather highly regarded because they are, as “hand methods” 
go, rather rapid in operation and usually quite simple. However, from their veiy nature they 
entail the disadvantage that a single-letter omission or addition may render their decryptograph¬ 
ing difficult if not impossible for the average cryptographic clerk. But from the standpoint of 
modem cryptography the principal disadvantage of transposition methods is that they can be 
mechanized only with great difficulty—certainly with greater difficulty than is the case of sub¬ 
stitution methods. Only one or two attempts have been made to produce machinery for effecting 
transposition, and these have not been successful. 

b. Pure transposition, that is, transposition by itself, without an accompanying substitution 
or other means of disguise for the letters of the plain text, hardly affords sufficient guarantees for 
cryptographic security in the case of a voluminous correspondence which must be kept really 
secret for any length of time. For no matter how complex the method, or how many trans¬ 
positions may be applied to the letters of a single message, sight must never be lost of the fact 
that when there are many messages in the same key there are bound to be two or more of identical 
length; and when this is the case the type of solution described in paragraph 26 may be applied 
to these cryptograms, the transposition keys recovered, and then all other messages in the same 
key translated. 

c. A message may undergo monoalphabetic substitution and the resulting text passed through 
a simple transposition. When this is the case a uniliteral frequency distribution wiU, of course, 
exhibit all the characteristics of monoalphabeticity, yet the cryptogram wiU resist aU attempts 
at solution according to straightforward simple substitution principles. It is usuaUy not difficult 
to detect that a transposition is involved because there wiU not only be long strings of low- 
frequency letters or high-frequency letters but what is more important, there vnll be very Jew or 
no repetitions of digraphs, trigraphs, and tetragraphs, since these will be broken up by the trans¬ 
position. When a uniliteral'distribution presents aU the external evidences of monoalphabeticity 
and yet there are no repetitions, it is almost a positive indication of the presence of transposition 
superimposed upon the substitution, or vice versa. (The former is usuaUy the case.) 

d. When confronted with such a situation the cryptanalyst usuaUy proceeds by stages, 
first eliminating the transposition and then solving the substitution. It is of course obvious 
that the general solution for transposition ciphers (cryptograms of identical length in the same 
key) wiU not be applicable here, for the reason that such a solution is based upon anagramming, 
which in turn is guided by the disclosure of good digraplis, trigraphs, and polygraphs. Since the 
letters of a combined substitution-transposition cipher are no longer the same as the original 
plain-text letters, simple anagramming of columns formed by superimposing identical-length 
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cryptngr «.Tn g can yield no results, because there is nothing of the nature of plain text to guide the 
cryptanalyst in his juxtaposition of columns.* 

e. Of course, if it should happen that the substitution process involves known alphabets, 
the cryptanalyst can remove the effects of the substitutive process before proceeding to elim¬ 
inate the transposition, even if in the encipherment the substitution came first. For example, if 
a standard cipher alphabet were employed for the substitution the uniliteral frequency distri¬ 
bution would give indications thereof and the cipher letters could immediately be converted 
to the normal plain-text equivalents. The latter may then be studied as though merely trans¬ 
position had been applied. But if unknown mixed cipher alphabets were employed, this initial 
step can not be accomplished and a solution must usually wait upon the removal of the trans¬ 
position before the substitution can be attacked. The latter may be very difficult or impossible 
where a good transposition method is used; where simple columnar transposition is used the 
removal of the transposition can be effected if the message is long enough. 

/. Of course if nothing is known about the system of transposition that has been employed, 
there is hardly anything to do but experiment with various types of transposition in an attempt 
to bring about such an arrangement of the text as wiU show repetitions. If this can be done, 
then the problem can be solved. For example, suppose that a message has been enciphered by a 
single mixed cipher alphabet and the substitution text has then been inscribed within a rectangle 
of certain dimensions according to one of the usual routes mentioned in paragraph 5 of this text. 
Repetitions in the plain text will of couise be preserved in the substitution text but wiU be 
destroyed after the transposition has been applied. The cryptanalyst, however, in his attempts 
to eliminate the transposition, may experiment with route transpositions of the various types, 
employing rectangles of various dimensions as suggested by the total number of letters in the 
ciyptogram. If he perseveres, he will find one route which he will know is correct as soon as he 
tries it because it vnll disclose the repetitions in the plain text, although the latter are still covered 
by a substitution. 

g. Practically all the methods of transposition which may be applied to plain text may also 
be applied to a text resulting from an initial transformation by substitution. As already men¬ 
tioned, route transposition may be used; reversed and rail-fence writing, columnar transposition 
with or without keying and with complete or incomplete rectangles are also possible. From a 
practical standpoint, keyed-columnar transposition applied to a monoalphabetic substitution is 
not only a popular but also a fairly secure combination because in this case the elimination of the 
transposition is a rather difficult matter. If the rectangle is completely filled the problem is not 
insurmountable in the case of a long message transposed by means of transposition with a rec¬ 
tangle of fairly small dimensions. For by assuming rectangles of various dimensions suggested 
by the total number of letters, cutting the columns apart, and then combining columns on the 
basis of the number of repetitions produced within juxtaposed columns and between different 
sets of juxtaposed columns, it is possible to reconstruct the rectangle and thus remove the trans¬ 
position phase. This, however, is admittedly a slow and difficult process even under the most 
favorable conditions; and if the rectangle is incompletely filled the process is very difficult. For 
in the latter case the lack of absolutely clear-cut knowledge as to the lengths of the columns, the 
juxtaposition of columnar material becomes replete with imeertainties and engenders feelings 
of confusion, hopelessness, and inadequacy in the mind of the cryptanalyst. However, he need 

' It should, however, not be inferred that anagramminf; processes are entirely excluded in the cryptanalysis 
of all combined substitution-transposition systems. In certain cases the anagramming process may be guided 
by considerations of frequency of letters or fragments of letters. A case of this kind will be encountered in the 
solution of the ADFGVX cipher, par. 40. 














not be wholly in despair if he is confronted with a problem of this nature in war time, when 
many cryptograms become available for study. For there are special methods of solution suitable 
to the occasion, created by special circumstances attendant upon the interception of a voluminous 
traffic. In subsequent paragraphs the student will come to understand what is here meant by 
the special circumstances and will learn of these special solutions. 

36. Other types of combined substitution-transposition systems.— a. There is no technical 
obstacle to tlie application of a transposition to the text resulting from any type of substitution, 
even if the latter is polyalphabetic or polygraphic in nature. The obstacles, or rather objections, 
to such combinations are practical in their chnractcr—they arc too complex for ordinary use and 
the prevalence of errors makes them too difficult to handle, as a general rule. However, they 
have been and are sometimes used even as field ciphers. For instance, on the southeastern front 
during the World War, the Central Powers made use of a somewhat iiTCgular polyalphabetic sub¬ 
stitution involving four standard alphabets and a keyed coliunnar transposition with incom¬ 
pletely-filled rectangles of a relatively large number of columns. Nevertheless, messages in this 
system were solved by taking advantage of tlie possibility of devising special solutions. 

b. A few remarks may be made in regard to the order in which the two processes, sub¬ 
stitution and transposition, are employed in a combined system. It is clear that when the 
substitution is monoalphabctic it is immaterial, so far as ciyptographic security is concerned, 
whether substitution is followed by traiisposition or vice versa, because the equivalent of each 
plain-text letter remains fixed regardless of the order in which the plain-text letters appear in 
the plain text. However, if the substitution is polyalphabetic in character it is better that the 
transposition process precede the substitution process, and that the number of alphabets em¬ 
ployed be different from the number of elements in the transposition key, if columnar trans¬ 
position is the case. The best situation, from a cryptographic security standpoint, is when 
the two key lengths (substitution and transposition) have no common factor. If the two keys 
are of the same length, the letters in each column are enciphered by the same cipher alphabet 
and thus the cryptogram would contain a certain number of sections of approximately equal 
length, composed of letters falling in the same cipher alphabet. 

c. Digraphic substitution, such as that produced by the Playfair Cipher, may be combined 
with transposition to yield cryptograms of fair security. But here again the elimination of the 
transposition phase by taking advantage of special circumstances or by rearranging the |/fext so 
as to uncover the repetitions which are inevitable in the Playfair Cipher, will result in solution. 

d. A particularly fruitful source of combined substitution-transposition is to be found in those 
methods generally designated as fraetionating systems, in which in the substitution phase each 
plain-text letter is replaced by an equivalent composed of two or more components or “fractions” 
and then these components are subjected to transposition in a second phase. This latter may be 
followed by a third phase, recombination of distributed components, and a fourth phase, the 
replacement of the recombined components by letters. Thus, such a system comprises a first 
substitution, a transposition, a recombination, and a second substitution.^ In the subsequent 
paragraphs certain systems of this sort will be dealt with in detail. They are interesting examples 
of practical systems of cryptography which have been used in the field of militaiy operations in 
the past and may again be used in the future. The first one to be discussed is particularly inter¬ 
esting for this reason alone; but it is also of interest because it will serve as a model for the student 
to follow in his study of methods for the solution of combined substitution-transposition ciphers 
in general. 

* See Special Text No. 166, Advanced Military Cryptography, sec. XI. 
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37, Introductory remarks.— a. One of the most interesting and practical of the many 
methods in which substitution and transposition are combined within a single system is that 
known in the literature as the ADFGVX cipher.* In this system a 36-character bipartite substitu¬ 
tion checkerboard is employed, in the cells of which the 26 letters of the alphabet and the 10 
digits are distributed in mixed order, often according to some key word. The row and column 
indicators (coordinates) are the letters ADFGVX, and, taken in pairs, the latter are used as substi¬ 
tutes for the letters of the plain text. These substitutive pairs are then inscribed within a rec¬ 
tangle and a columnar transposition takes place, according to a numerical key. The cipher text 
consists then merely of the 6 letters A, D, F, G, V, and X. » 

b. The ADFGVX cipher system was inaugurated on the Western Front by the German Army 
on March 1, 1918, for communication between higher headquarters, principally between head¬ 
quarters of divisions and corps. When first instituted on March 1, 1918, the checkerboard con¬ 
sisted of 25 cells, for a 25-letter German alphabet (J was omitted), and the 5 letters A, D, F, G, and 
X used as coordinates. On June 1 the letter V was added, the checkerboard having been enlarged 
to 36 cells, to take care of a 26-letter alphabet plus the 10 digits. Transposition keys ranged from 
15 to 22 numbers, inclusive, and both the checkerboard and the transposition key were changed 
daily The number of messages in this system varied from 25 a day upon the inception of the 
system to as many as 150 per day, during the last days of May 1918. The first solution was made 
on April 6 by the French. The cipher continued in use rather extensively until late m June but 
from that time until the Armistice the volume of messages diminished very considerably. 
Although only 10 keys, covering a period of as many days were ever solved, the proportion of 
solved messages in the whole intercepted traffic was about 50 percent. This was true because of 
the fact that the keys solved were those for days on which the greatest number of messages was 
intercepted The same system was employed on the southeastern front from July 1918 to the 
end of the war. Keys were in effect at first for a period of 2 days and beginning on September 1, 
for a period of 3 days. In all 17 keys, covering a total of 44 days, were solved. 

e At the time that the Allied cryptanalytic offices were working with cryptograms m this 
system only three methods were known for their solution and all three of them are classifiable 
under the heading of special solutions, because certain conditions had to obtain before they 
could be applied. No general solution had been developed until after hostilities had ceased. 


* Special Text No. 166, Advanced Military Cryptography, sec. XL _ 

» The general solution to be described in paragraphs 41-43 was not established until after the Am^tic^ 
Had it been elaborated earlier there would no doubt have been many more solutions than were actually effected 
by the methods then available. 
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Because they are interesting and useful some attention will be devoted to both the general and the 
special solutions. Since the special solutions are easy to understand and serve as a good introduc¬ 
tion to the general solution, they wiU be taken up first. 

88. Special solution by means of identical endings.-a. In paragraph 24 it was demonsta-ated 
how the solution of keyed-columnar transposition ciphers can be facilitated and simplified by the 
companson of two cryptograms which are in the same key and the plain-text endings of which 
Me Identical, It was noted in that case that a study of the irregularly distributed cipher-text 
Identities between the two cryptograms permits of not only cutting up the text into sections 
that correspond with the long and the short columns of the transposition rectangle but also of 
^abhshing the transposition key in a direct manner almost entirely mathematical in nature. 
V^en this has been accomplished the plain texts of these two messages are at once disclosed, and 
all other messages in the same key may be read by means of the key so reconstructed. 

h. The same method of solution is applicable to the similar situation, if it can be found, in 
the case of the ADFGVX system, except that one more step intervenes between the reconstruction 
of the transposition rectangle and the appearance of the plain text in the rectangle; A mono- 
alphabetic substitution must be solved, since the text in the rows of the rectangle does not 
consist of plam-text letters but of pairs of components representing these letters as enciphered by 
means of a bipartite substitution alphabet. Moreover, this latter step is comparatively simple 
when there IS a sufficient amount of text in the two rectangles; if not, additional material for use 
m solving the monoalphabet can be obtained from other cryptograms in the same key, if they are 
available, since the transposition key, having already been reconstructed from the two ciynto- 
identical endings, will permit of inscribing all other cryptograms in the same key 
within their proper rectangles. 

/ * 1 * application of the principles involved in such a solution will be 

useful. The following cryptograms have been intercepted on the same date, the 20th: 

No. 1 

To CG 22d Brigade: 

XVAAX VDDAG DADVP ADADA PXGFV XFAXA 

XVAVF AVXAD GFFXP FGAGF DGDGD DGAFD 

AADDD XDAVG GAADX ADFVF FDFXF GFGA*V 

AFAFX PPXFX FVDVX AFFGX A A A V A VAFAG 


DDFAG VFADV FAVVX GVAAA FDFAX XFAAG 


No. 2 


> CG 23d Brigade: 
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m 190 

DXDAF AGXXA FGAV 


d. The delimitation and marking of identities between these two cryptograms is a procedure 
similar to that explained in paragraph 246, except that a little more study may be necessary in 
this case because occasionally there may be considerable uncertainty as to exactly where an 
identity begins or ends. The reason for this is not difficult to understand. Whereas in para¬ 
graph 246 the process involves “unfractionated” letters and there are about 18 or 20 different 
letters to deal with, so that an “accidental identity” is a rather rare occurrence, in the present 
problem the process involves fractions of letters (the components of the bipartite cipher equiva¬ 
lents), and there are only 6 different characters to deal with, so that such “accidental identities” 
are quite frequent. Now the cryptanalyst is not able at first to distinguish between these acci¬ 
dental identities and actual identities and this is what makes the process somewhat difficult. 
What is meant will become perfectly clear presently. 

e. Taking the two illustrative cryptograms, the first step is to ascertain what identities 
can be found between them, and then mark off these identities. For example, it is obvious that 
if the messages end alike the last several letters in No. 1 should be found somewhere in No. 2, 
and likewise the last several letters in No. 2 should be found somewhere in No. 1. The number 
of letters in identical sequences will depend upon the length of the identical text and the width 
of the transposition rectangle. Searching through No. 2 for a sequence such as A G D X, or 
G D X, or at least D X, the tetragraph A G D X is found as letters 151-54, The last column of No. 2 
ends with F G A V; searching through No. 1 for a sequence F G A V, or G A V, or at least A V, the 
tetragraph F G A V is found as letters 87-90. These identities are imderlined or marked off in 
some fashion, and search is made for other identities. It would be a great help if the width of 
the transposition rectangle were known, for then it would be possible to cut up the text into 
lengths approximately corresponding to column lengths, and this would then restrict the search 
for identical sequences to those sections which correspond to the bottoms of the columns. Sup¬ 
pose the key to contain 20 numbers. Then the rectangle for No. 1, containing 152 letters, 
would consist of 12 long columns of 8 letters and 8 short ones of 7 letters; that for No. 2, con¬ 
taining 194 letters, would consist of 14 long columns of 10 letters and 6 short ones of 9 letters. 
If that were correct then in No. 1 the end of the first column would be either X V D D, or X V D. 
Searching through No. 2 for either of these a sequence X V D D is found as letters 84-7. Column 
1 is probably a long column in No. 1. The word probably is used because the identity may 
extend only over the letters X V D, and the next D may be an accidental simUarity, since the chances 
that D will appear by pure accident ere 1 in 6, which is not at all improbable. It must also be 
pointed out that a certain number of telegraphic errors may be expected, and since there are 
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only 6 different letters the chances that an F, for example, will be received or recorded as a D 
are fairly good. Column 1 of No. 2 ends either with V F A D or V F A. Searching through No. 1, 
a sequence V F A D is found as letters 14-17; a sequence V F A is found as letters 34-6; a sequence 

V F F p k found as letters 79-82; a sequence V F A D is also found as letters 126-130; a sequence 

V F A IS found as letters 130-2. Here are several possibilities; which is the one to choose? Two 
of these possibilities coincide exactly with the full sequence being sought, V F A D. Can one of 

“ possibility? Perhaps tables to facilitate the location of possible “breaks” 
will be helpful in making the elimination (see paragraph lOn). “Break tables” are therefore 
constructed for the messages on the basis of rectangles of 20 columns, and are as shown below. 
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From these tables it follows that as regards message No. 1 there can be a break after the 7th, 8th, 
14th, 15th, 16th . . . letters but not after the 6th letter, nor after the 9th to 14th letters, nor 
after the 17tli to 2l8t letters, and so on; as r^ards message No. 2 there can be a break after the 
9th, lOth, 18th, 19th, 20th, . . . letters but not after the 8th letter nor after the 11th to 18th 
letters, nor after the 2l8t to 27th letters, and so on. Referring again to the two VFAD sequences 
in No. 1 which may correspond with the VFAD sequence in No. 2, it was found that the first 
candidate would require a break immediately after the 17th letter. But the break table for No. 1 
precludes this possibility; hence the first VFAD sequence in No. 1 in position 14-17 may be elimi¬ 
nated as a candidate, leaving the second VFAD, in position 126-130, as a candidate. This would 
require a break after the 130th letter and reference to the break table for No. 1 shows this to be a 
possibility. Hence, the VFAD in position 126-130 in No. 1 will tentatively be accepted as 
matchii^ the VFAD sequence in No. 2. Another section of the text of one or the other ciypto- 
gram is next selected, with a view to establishing additional identities. To go through the 
whole process here would consume too much space and time. Moreover, it is not necessary, 
for the only purpose in carrying the demonstration this far is to indicate to the student the 
general procedure and to show him some of the difficulties he will encounter in the identifica¬ 
tion of the similar portions when the text is composed of only a very limited number of different 
letters. In this case, after more or less tedious experimentation, the hypothesis of a key of 20 
columns is established as correct, whereupon two sets of 20 identities are uncovered and the 
identities are found to be as shown below. 
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Fiqube 47—Continued 

/. A table of equivalencies ® is then drawn up: 

No. 1--. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

No. 2.. 9 6 8 10 13 11 17 2 19 15 7 20 14 12 5 18 1 4 3 16 

Since the rectangle for No. 2 has 2 more letters in the last row than the rectangle for No. 1, 
two chains of equivalents at two intervals are constructed. Thus: 



4 10 15 5 13 14 12 20 16 18 

These chains must now be united into a single chain by proper interlocking. Since cryptogram 
No. 1 has 12 long columns, and since the identities of these 12 columns are now known (1, 3, 
5, 7, 9, 12, 13, 14, 16, 17, 19, 20), the interlocking of the two chains and hence the transposition 
key must be this: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

7 5 17 13 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 15 

g. The two cryptograms may now be transcribed into their proper transposition matrices, 

as shown in figure 48. 

• It is necessary to remark that in setting up the table of equivalencies, after determining the width of the 
rectangle, that message which has the lesser number of long columns is used as the basis for the normal sequence 
1, 2, 3, .... If the one having the greater number of long columns is employed as the base, the reconstructed 
key will be reversed. 
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No. 1 No. 2 

7 » 17 13 1 14 9 12 19 20 3 16 8 18 a 4 6 10 II IS 7 g 17 13 1 14 9 12 19 20 3 16 8 18 8 4 6 10 11 It 

FXDAXFAFVXAVGVAFAVAF AFXVFVAFFFFAAFDFAFAX 

GVFFVXAXAXDADFGVDGDF AXFDDAFAFADAFFVVDAFA 

AAAAAFDFAFAVDADXGGFG GVDAFDDXDGAAFXFAGDFA 

GVGFAVDGAADAGVAFFAVX VXFVFXVXDXGVFDVXXDAV 

FFVXXDDFFAAFAVDAFAFA GDAFFFFAVXAVXGDGFAFX 

DAFFVVXGDGFAFXVXXDFA VXXDFAVADADGDXGDFAVX 

GVAFDXDAFDXGDGFAFXDA FVFFVXXDDFFAAFAVDAFA 

DXDXDAAVAXGD FADAFFVVXGDGFAFXVXXD 

FAGVAFDXDAFDXGDGFAFX 

DADXDXDAAVAXGD 

Fioumt 48. 

A. A frequency distribution is now made of all tlie bipartite pairs, so as to solve the encipher¬ 
ing checkerboard. There is no necessity for going through this part of the solution, for it falls 
along quite normal lines of monoalphabetic substitution. The two plain-text rectangles are 
shown in figure 49. The checkerboard * is found to be as shown in figure 50o. 
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FioCBE 48. 


< Since the second cryptogram is addressed to the CG 23d Brigade and the first cryptogram mentions that 
the commander of that brigade has been ordered to do so and so, the solution of the groups GG (=2) and FG 
(■=3) is made by inference. This gives the placement of these two digits in the cipher square. 
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No. 2 


7 5 

17 13 

1 

9 12 

19 20 

3 IS 

8 18 

2 4 

6 10 

11 15 

E 

X 

P 

E 

c 

T 

E 

N 

E 

M 

A F 

X V 

F V 

A F 

F F 

F A 

A F 

D F 

A F 

A X 

M 

Y 

A 

T 

T 

A 

C 

K 

A 

T 

A X 

F D 

D A 

F A 

F A 

D A 

F F 

V V 

D A 

F A 

D 

A 

Y 

L 

I 

G 

H 

T 

S 

T 

G V 

D A 

F D 

D X 

D G 

A A 

F X 

F A 

G D 

F A 

0 

P 

H 

0 

L 

D 

Y 

0 

U 

R 

V X 

F V 

F X 

V X 

D X 

G V 

F D 

V X 

X D 

A V 

S 

E 

C 

T 

0 

R 

W 

I 

T 

H 

G D 

A F 

F F 

F A 

V X 

A V 

X G 

D G 

F A 

F X 

0 

U 

T 

F 

A 

I 

L 

S 

T 

0 

V X 

X D 

F A 

V A 

D A 

D G 

D X 

G D 

F A 

V X 

P 

C 

0 

U 

N 

T 

E 

R 

A 

T 

F V 

F F 

V X 

X D 

D F 

F A 

A F 

A V 

D A 

F A 

T 

A 

c 

K 

W 

I 

T 

H 

0 

U 

F A 

D A 

F F 

V V 

X G 

D G 

F A 

F X 

V X 

X D 

T 

D 

E 

L 

A 

Y 

W 

I 

T 

H 

F A 

G V 

A F 

D X 

D A 

F D 

X G 

D G 

F A 

F X 

A 

L 

L 

A 

R 

M 

S 




D A 

D X 

D X 

D A 

A V 

A X 

G D 





FwtiBB 49—Continued. 

2nd oomponent 

ADFGVX ADFGVX ADFGVX 



i. Speculating upon the disposition of the letters within the enciphering checkerboard, it 
becomes evident that the key phrase upon which it is based is GERMAN MILITARY CIPHERS. 
The fact that the digit 2 follows B and the digit 3 follows C suggests that the digits arc inserted 
immediately after the letters A, B, C, . .., as they occur in the mixed sequence. Note the cells 
which still remain vacant after the key word mixed sequence is fully developed in the checker¬ 
board, and all the letters which do occur in the two messages are inserted in their correct cells 
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(fig. 506). The complete checkerboard may therefore be taken almost certainly to be as shown 
in figure 50c. The date (20th) indicates that the transposition key will have 20 numbers in it. 
The transposition key was evidently derived from the first 20 letters of the mixed sequence: 

GERMANILTYCPHSBDFJKO 

7 S 17 13 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 15 

39. Special solution by means of identical beginnings.— a. In paragraph 23 was demon¬ 
strated the method of solution based upon finding two cryptograms which are in the same key 
and the plain texts of wliich begin with the same words. The application of this method to the 
con-esponding situation in the case of the ADFGVX system should by this time be obvious. The 
finding of identical sequences is somewhat easier in this case than in the case of identical endings 
because the identities can be found in parallel progression from the begin ning to the end of the 
two cryptograms being compared. Moreover, the discovery of two cryptograms with similgr 
beginnings is easier than that of two with similar endings because in the former case the very 
first groups in the two cryptograms contain identities, whereas in the latter case the identities 
are hidden and scattered throughout the texts of the two cryptograms. On the other hand, the 
complete solution of a case of identical endings is very much more simple than that involving 
identical begiimings because in the former case the estabhshment of the identities carries with it 
almost automatically the complete reconstruction of the transposition key, whereas in the latter 
this is far from true and additional cryptograms may be essential in order to accomplish this 
sine qua non for the solution. 

b. The following represent 8 cryptogi-ams of the same date, assumed to have been enciphered 
by the same key. 

No. 1 


V 

D 

D 

F 

A 

X 

F 

A 

A X 

D 

X 

G 

G 

F 

F 

V 

F 

X 

F 

G 

X 

D 

X 

G 

D 

G 

A 

G 

F 

A 

G 

D 

A 

D 

V 

G 

G 

D 

A 

A 

A 

D 

X 

X 

D 

X 

A 

F 

F 

A 

A 

D 

A 

F 

D 

F 

F 

D 

A 














No. 

2 















G 

X 

D 

D 

A 

D 

D 

G 

D 

F 

V 

G 

X 

A 

X 

X 

X 

G 

X 

G 

A 

A 

A 

A D 

F 

A 

D 

D 

X 

A 

V 

D 

X 

F 

X 

A 

D 




































No. 3 















X 

D 

A A 

A 

G 

X 

D 

D 

X 

V 

F 

F 

V 

D 

G 

A 

D 

F 

D 

X 

A 

A 

A 

G 

D 

F 

A 

D 

G 

A 

F 

D 

A 

D 

G 

V 

G 

D 

V 

F 

D 

F 

X 

A 

G 

F 

X 

A 

F 

A 

F 

A 

X 

D 

D 

D 

D 

F 

D 

X 

A 

X 

V 

A 

D 

X 

F 

X 

F 

D 

G 

A 

G 

F 

G 

G 

A 

D 

D 

A 

G 

D 

G 

X 

A 

V 

G 

D 

G 

A 

D 

A 

F 

A 

X 

F 

A 

A 

G 

V 

A 

A 

G 

A 

F 

D 

V 

D 

V 

D 

X 

F 

D 

A 

X 

F 

D 

F 

F 

G 

D 

X 

D 

V 

D 

A 

D 

A 

V 

D 

A 

D 

D 

D 

G 

A 

D 

A 

G 

A 

A 

A 

F 

G 

G 

D 

X 

A 

X 

F 

G 

V 

X 

D 

D 

G 

D 

D 

F 

A 

F 

A 

G 

V 

A 

F 

G 

X 

G 

V 

D 

D 

A 

X 

X 

D 

V 

F 

F 

F 

F 

D 

X 

G 

V 

G 

D 

F 

G 

A 

V 

A 

D 

A 

X 

D 

A 

F 

A 

A 

F 

D 

G 

F 

V 

F 

X 

X 

X 

A 

A 

G 

A 

G 

A 

F 

D 

G 

X 

A 

F 

A 

F 

X 

X 

G 

G 

A 

G 

A 

A 

F 

F 

A 

A 

F 

D 

G 

A 

G 

A 

F 

V 

X 

D 

G 

G 

F 

G 

D 

A 

A 

A 

F 

D 

A 

D 

A 

D 

X 

V 

V 

A 

X 

F 

V A 

D 

D 

G 

A 

F 

F 

F 

G 

X 

A X 

D 

F 

D 

D 

F 

X 

A 

A 

A 

A 

A 
























No. 4 















A 

F 

G 

F 

X 

A 

G 

X 

A 

G 

X 

D 

D 

A 

F 

A 

A 

X 

A 

V 

G 

D 

D 

D 

D 

F 

A 

F 

G 

V 

D 

G 

D 

X 

A 

F 

D 

X 

A 

X 

G 

F 

G 

D 

D 

V 

A 

D 

X 

A 

X 

G 

F 

A 

X 

F 

DAD 

D 

G D 











































No. 5 















X 

AAA 

D 

D 

G 

A 

A 

G 

D 

D 

D 

X 

F 

F 

A 

V 

G 

A 

X 

D 

G 

G 

D 

F 

F 

A 

V A 

D 

A 

A 

X 

A 

G 

D 

X 

D 

X 

X 

X X 

D 

G 

V 

F 

A 

D 

A 

D 

F 

F 

F 

F 

V V 

G 

F 

D 

X 

F 

D 

G 

G 

D 

A 

X 

D 

G 

A 

D 

F 

D 
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No. 6 


X D A A V 
G D F D A 
F D X A X 
G G F D D 
A D F F G 
D D D A V 
D X D V F 
X F D A G 
A F F A A 
V A X D A 
D G 


A G F G V 
D D A X X 
D V A X A 
D D A F F 
X D D V 


D F G F X 
V V F D A 


D X D G F 
A A G A X 
G A X F F 
D V F F V 
D G F D A 
G A V A D 
F X V A X 
A G A V D 
F F F D V 
G A D X D 


D D D D F 
A A D D F 
X F X D A 
V D G X A 


D F A F F 
A A X G D 


X V G D D 

D V F D F 

V D V A F 

V A G V A 

A F G A X 

F G D D F 

G F D A G 

V A G A F 

D F F A F 

V F A F F 


A V G X A 
D F F D D 
G V D V D 
X A A G G 
F F D V D 
F D G D V 
X F F F F 
D G D A V 
D A G D G 
F G D D A 


D X A A D 
F D D F X 
D D A G D 
X G X D D 
D D A G A 
D G G X A 
A A X D A 
V D D D D 
G A A A F 
D D D F A 


A X V D D 
X D F A D 
G F F G X 
X G X A G 


D D F G A 
A F A G 


X G G A A 
F X X F D 
G G D A A 
D A D X F 
F A D A V 
X A X D A 
F V D X G 
D F X G V 
D X A X A 
G D F A X 


V D V X A 
D F D G D 
D A D F A 
A G D G V 


X G V D F 


No. 7 

DDFXF DDGDF 
AGGFF AXDDG 
FXDDG FXGDV 
ADXFX GVADA 

No. 8 

XDXAG ADGGG 
AVDVA DDGVD 


The cryptograms have been examined for identical beginnings, and Nos. 3 and 6 apparently 
begin ^ke, identical portions being imderlined as shown in figure 51. Now the number of 
identical sections in the two cryptograms is 15; this indicates that the width of the transposition 
rectangle is 15. Therefore, No. 3 (290 letters) has 5 long columns of 20 letters and 10 short 
columns of 19 letters [(15X20) —10=290]. No. 6 (302 letters) has 2 long columns of 21 letters 
and 13 short columns of 20 letters [(15X21) —13=302). The identical sections in No. 3 and 
No. 6 having been marked off as shown in figure 51, the next step is to transcribe the texts into 
their correct colmnn lengths as given by the study of identical sections, writing them merely 
in their serial order, as shown in figure 62. In this transcription no serious difficulty is usually 
encountered in the division into correct column lengths, this process being guided by the identical 
sequences, the munber of letters between the identical sequences, and the maximum and minimum 
lengths of the colmnns as calculated from the dimensions of the rectangle. Whenever difficulties 
are encountered in this process, they are brought about by accidental identities of letters before 
and after the true or actual identical sequences. In the present case no such difficulties arise 
except in going from column 12 to column 13. The identical sections for column 13 here consist 
of the sequence A F F A A F; if these sections are placed at the head of column 13, it leaves column 
12 one letter short at the bottom in each diagram. This means that the initial A’s in these 
identical sequences represent an accidental identity; these A’s belong at the bottom of colimm 
12 in each diagram, and the true identical sequences are F F A A F, and not A F F A A F. In 
some cases there may be many more instances of such accidental identities before and after the 
true identical sequences. Another thing to be noted is that the identical beginnings in this 
case run along for at least 4 complete rows and part of the fifth row in the transposition rectangle. 
Therefore, the identical sequences should consist of not less than 4, and not more than 5 letters; 
any letters in ^cess of 6 in any identical sequence are accidental identities. There are several 
such accidental identities in the case under study, viz, in columns 5 and 12. 



1 X D A A A 

G X D D X 

V F F V D 

G A D F p_ 

X A A A G 

D F A D G 

A F D A D 

G V G D V 

F D F X A 

G F X A F 

A F A X D 

D D D F D 



3 



4 

X A X V A 

D X F X F 

D G A G F 

G G A D D 

A G D G X 

A V G D G 

A D A F A 

X F A A G 

V A A G A 

F D V D V 

D X F D A 

X F D F F 



6 



7 

G D X D V 

D A D A V 

D A D D D 

G A D A G 

_A A A F G 

G D X A X 




8 



F G V X D 

D G D D F 

A F A G V 

A F G X G 

V D D A X 

X D V F F 


9 




10 

F F D X G 

V G D F G 

A V A D ^ 

X D A F A 

A F D G F 

V F X X X 




11 



A A G A G 

A F D G X 

A F A F X 

X G G A G 

A A F F A 

A F D G A 


12 



13 


G A F V X 

D G G F G 

D A A A F 

D A D A D 

X V V A X 

F V A D D 



14 




G A F F F 

_G X A X D 

F D D F X 

A A A A A 



15 








No. 6 



X D A A V 

D X D G F 

X V G D D 

A V G X A 

D X A A D 

X G G A A 

1 




2 


G D F D A 

A A G A X 

D V F D F 

D F F D D 

F D D F X 

F X X F D 

F D X A X 

G A X F F 

V D V A F 

G V D V D 

D D A G D 

_G G D A A 

4 




5 


j G G F D D 

D V F F V 

V A G V A 

X A A G G 

X G X D D 

D A D X F 

A D F F G 

_p G F D A 

A F G A X 

F F D V D 

D D A G A 

F A D A V 

7 




8 




D D D A V 

G A V A D 

F G D D F 

9 

F D G D V 

D G G X A 

X A X D A I 1 


D X D V F 

10 

_F X V A X 

G F D A G 

X F F F F 

A A X D A 

11 

_F V D X G 


X F D A G 

A G A V D 

V A G A F 

12 

_^G D A V 

V D D D D 

D F X G V ‘1 1 


A F F A A 

13 

_F F F D V 

D F F A F 

D A G D G 

G A A A F 

14 

J) X A X A 


V A X D A 

D G 

G A D X D 

VFAFF FGDDA 

16 

Fiovsi 61. 

D D D F A 

G D F A X i 

i 
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No. 6 


3 4 6 6 7 8 » 10 11 12 13 14 U 


X 

D 

D 

F 

D 

A 

D 

D 

G 

X 

* 

A 

F 

A 

A 

D 

X 

V 

D 

D 

G 

F 

A 

D 

D 

X 

G 

F 

A 

F 

A 

A 

F 

X 

A 

V 

F 

G 

D 

V 

D 

A 

A 

A 

F 

A 

A 

D 

A 

G 

A 

G 

A 

E 

F 

A 

F 

A 

F 

F 

V 

D 

1 

X 

D 

X 

D 

F 

F 

E 

E 

D 

E 

D 

G 

D 

X 

D 

G 

G 

A 

G 

A 

D 

== 

V 

G 

F 

X 

D 

X 

G 

F 

A 

G 

A 

F 

D 

G 

V 

D 

D 

F 

A 

D 

D 

G 

F 

X 

D 

G 

D 

A 

D 

* 

* 

A 

D 

X 

A 

G 

A 

D 

F 

A 

G 

A 

V 

V 

X 

G 

V 

V 

A 

D 

F 

A 

D 

F 

A 

X 

A 

D 

D 

G 

X 

V 

D 

V 

D 

X 

G 

F 

V 


G 

F 

D 

G 

F 

F 

D 

F 

A 

D 

V 

D 

D 

D 

G 

X 

iZ 

D 

G 

D 

|Z 

D 

F 

X 


G 

F 

D 

V 

F 

D 

A 

A 

X 

A 

A 

D 

A 

D 

A 

D 

D 

F 

A 

D 

D 

|Z 

V 

A 

G 

|Z 

D 

F 

!_A_ 


D 

A 

X 

IT 

D 

D 

F 

G 

X 

X 

A 

D 

D 

G 

lL 

A 

A 

F 

G 

D 

A 

F 

A 

A 

F 

G 

F 

A 

A 

F 

V 

A 

X 

V 

V 

D 

D 

V 

X 

F 

A 

X 

G 

z 

A 

G 

G 

X 

D 

F 

X 

V 

A 

D 

F 

V 

G 

D 

X 

X 

X 

A 

F 

V 

F 

F 

D 

D 

A 

F 

D 

V 

G 

D 

D 

A 

X 

D 

D 

V 

A 

D 

F 

D 

A 

T 

A 

G 

V 

G 





V 









F 



ViavRS 52—Continued. 


c. Now comes the attempt to place the columns in proper sequence in the respective trans¬ 
position rectangles. Since No. 6 has only 2 long columns, viz, 5 and 14, it is obvious that these 
two columns belong at the extreme left of the rectangle. Their order may be 5-14 or 14-5; 
there is no way of telling which is correct just yet. Since No. 3 has 5 long columns, viz, 3, 4, 5, 
7, 14, and since from No. 6 it has been ascertained that 5 and 12 go to the extreme left, it is 
obvious that columns 3, 4, and 7 occupy the third, fourth, and fifth positions in the rectangles. 
Their order may be any permutation of the three numbers 3, 4, and 7 ; their exact order must be 
ascertained by further study. 

824165—41-8 


L 

















































no 


d. In this study, to fix the exact order of the columns and thus to reconstruct the transposi¬ 
tion key, advantage can he taken of tlie diverse lengths of other cryptograms that may be 
available in the same key. In this case there are 6 additional cryptograms. Nos. 1, 2, 4, 5, 7, 
and 8, suitable for the purpose. The following calculations are made: 





Number of culumns j 


gfletters 

columns 

liong 

1 Short 1 

1 

60 

4 

1 

All same length 

2 

38 

3 and 2 

8 

7 

4 

62 

5 and 4 

2 

13 

5 

74 

5 and 4 

14 

1 

7 

124 

9 and 8 

4 

11 

8 

54 

4 and 3 

9 

6 


Now No. 7 has 4 lo ng columns, and these must consist of 4 columns from among the 5 already 
ascertained as falling at the extreme left, viz, 3, 4, 5, 7, and 14. Columns 5 and 14 have further¬ 
more been placed in positions 1-2, leaving columns 3, 4, and 7 for positions 3-4-5. Which 
of these three possibilities is to be omitted as a long column in No. 7? A means of answering 
this question involves certain considerations of general importance in the cryptanalysis of this 
type of system. 

e. Consider a transposition rectangle in which the number of colmnns is even, and consider 
specifically the first pair of columns in such a rectangle. The combinations of bipartite compo¬ 
nents formed by the juxtaposition of these 2 columns correspond to plain-text letters, and there¬ 
fore the distribution of the bipartite digraphs in these columns will be monoalphabetic in char¬ 
acter. The same is true with respect to the bipartite components in the third and fourth columns, 
the fifth and sixth columns, and so on. Hence, if a long cryptogram of this nature is at hand, 
and if the 2 columns which belong at the extreme left can be ascertained, then a distribution of 
the bipartite digraphs formed by juxtaposing these columns should not only be monoalphabetic, 
but also this distribution, ij it is at all normal, will ajfford a basis ;for matching other columns which 
will ‘produce similar distributions, for the text as a whole is monoalphabetic. In this way, by 
proper matching of columns, those which really go together to form the pairs containing the 
bipartite equivalents of the plain-text letters can be ascertained. From that point on, the solu¬ 
tion of the problem is practically the same as that of solving a columnar transposition cipher 
with nonfractionated letters. 

y. But now consider a plain-text rectangle in the ADFGVX system, in which the number of 
columns is odd, and consider specifically the first pair of columns in the rectangle. Now only the 
alternate combinations of bipartite components in these columns form the units of plain-text 
letters. The same is true of the bipartite components of the third and fourth, the fifth and sixth 
columns, and so on. In all other respects, however, the remarks contained in subparagraph e 
apply equally to this case where the width of the rectangle is odd. 

g. Returning to the problem under study, it has been ascertamed that columns 5 and 14 fall 
at the extreme left. Whether their correct order is 5-14 or 14-5 cannot at the moment be ascer¬ 
tained, nor is it essential. The thing to do is to make a distribution of the bipartite pairs and 
see wliat it is like. Since the width of the rectangle hero is odd, only the 1st, 3d, 5th, . . . pairs 
down the columns can be distributed in a frequency square. The results are shown in Fig. 53. 


Ill 


No. 3 

Col. Cd. 

1 D A 
D A 
3 A A 
G F 
5 D D 
G A 
7 X D 
A A 
9 V D 
G X 
11 D V 
G V 
13 A A 
D X 
15 A F 
F V 
17 A A 
X D 
19 F D 
A G 


No. 6 

Col. Col. 
J_U 

1 D A 
D A 
3 A A 

G F 
5 D D 

G X 
7 G A 

D X 
9 A A 

A V 
11 G A 

G X 
13 F D 

D A 
15 D G 

D A 
17 V D 

F X 
19 F D 

V V 
21 V F 


2U COMPONSNT 

AD F G V X 




1 




II 

II 


1 

1 



III 





H 







~ir 

1 


_ 1 



1 






h. The distribution is fairly good. Five occurrences of AA are noted, 3 of FD. These must 
represent high-frequency letters. The 0 {Phi) test for monoalphabeticity may be applied. 

Expected value of ^'for plain text=.0667X21X20=28.01 
Expected valueof 4> for random|text=.0385X21X20=16.17 

Observed value of in this case=(5X4)-t-(2Xl) + (2Xl) + (3X2) + (2Xl) + (2Xl)=34 

The observed value of <l> is considerably greater than the expected value for plain text and more 
than twice as much as the expected value for random text. Using the distribution in figure 53 as 
a basis, an attempt is made to add to the 5-14 combination a column selected from among columns 
3,4, and 7, so that the second, fourth, sixth . . . pairs down the second and third columns in the 
rectangle will give bipartite pairs that will conform to the distribution noted in figure 53. Since 
the results sought will be very materially affected if the combination 5-14 should really be 14-5, 
aU possible combinations of 5-14 and 14-5 with 3, 4, and 7 must be tried. The various combina¬ 
tions tested are shown in figure 54. 














(1) 

(2) 

112 

No. 3 

(3) 

(4) 

(5) 


5 14 3 

S 14 4 

5 14 7 

14 6 3 

14 3 4 

1 

DAD 

D A F 

DAD 

ADD 

A D F 

2 

D A V 

DAD. 

D A F 

A D V 

ADD 

3 

A A F 

A A X 

A A F 

A A F 

A A X 

4 

G F D 

G F A 

G F G 

F G D 

F G A 

5 

DDF 

D D X 

D D D 

DDF 

D D X 

6 

G A X 


G A X 

A G X 

A G V 

7 

X D A 

X D A 

X D D 

D X A 

D X A 

8 

A A G 

A A D 

AAV 

A A G 

A A D 

9 

V D F 

V D X 

V D D 

D V F 

D V X 

10 

G X X 

G X F 

G X A 

X G X 

X G F 

11 

D V A 

D V X 

DVD 

V D A 

V D X 

12 

G V F 

G V F 

G V A 

V G F 

V G F 

13 

AAA 

A A D 

AAV 

AAA 

A A D 

14 

D X F 

D X G 

D X D 

X D F 

X D G 

15 

A F A 

A F A 

A F A 

F A A 

F A A 

16 

F V X 

F V G 

F V D 

V F X 

V F G 

17 

A A D 

A A F 

A A D 

A A D 

A A F 

18 

X D D 

X D G 

X D D 

D X D 

D X G 

19 

FDD 

F D G 

F D G 

D F D 

D F G 

20 

A G D 

A G A 

A G A 

GAD 

G A A 


(1) 

(2) 

No. 6 

(3) 

n 

(5) 


5 14 3 

S 14 4 

6 14 7 


14 6 4 

1 

DAD 

D A F 

DAD 

ADD 

A D F 

2 

D A V 

DAD 

D A F 

A D V 

ADD 

3 

A A F 

A A X 

A A F 

A A F 

A A X 

4 

G F D 

G F A 

G F G 

F G D 

F G A 

5 

DDF 

D D X 

D D D 

DDF 

D D X 

6 

G X D 

G X G 

G X G 

X G D 

X G G 

7 

G A F 

G A A 

G A F 

A G F 

A G A 

8 

D X F 

D X X 

D X D 

X D F 

X D X 

9 

A A D 

A A F 

AAA 

A A D 

A A F 

10 

A V D 

A V F 

A V A 

V A D 

V A F 

11 

G A F 

G A V 

G A F 

A G F 

A G V 

12 

G X D 

G X D 

G X G 

X G D 

X G D 

13 

FDD 

F D V 

FDA 

D F D 

D F V 

14 

D A F 

D A A 

D A X 

A D F 

ADA 

15 

D G X 

D G F 

D G F 

G D X 

G D F 

16 

D A F 

DAG 

D A F 

A D F 

A D G 

17 

V D X 

V D V 

V D D 

D V X 

D V V 

18 

F X X 

F X D 

F X V 

X F X 

X F D 

19 

F D F 

F D V 

FDD 

D F F 

D F V 

20 

V V D 

V V D 

V V D 

V V D 

V V D 

21 

V F 

V F 

V F 

F V 

F V 


( 6 ) 

14 a 7 

ADD 
A D F 
A A F 
F G G 
D D D 
A G X 
D X D 
AAV 
DVD 
X G A 

V D D 
VGA 
AAV 
X D D 
F A A 

V F D 
A A D 
D X D 
D F G 
G A A 


(6) 

14 5 7 

ADD 
A D F 
A A F 
F G G 
D D D 
X G G 
A G F 
X D D 
AAA 

V A A 
A G F 
X G G 
D F A 
A D X 
G D F 
A D F 
DVD 
X F V 
D F D 

V V D 
F V 




i. Frequency distributions are now made. If combination 5-14-3 is correct for No. 3, it is 
also correct for No. 6. Hence, a single distribution is made of the bipartite pairs in rows 1, 3, 5, 
... of columns 5-14, and of the pairs in rows 2, 4, 6, . . . of columns 14-3. Similar tlistribu- 
tions are made of the pairs given under each of the other combinations. These distributions arc 
shown in figure 55. 

(1) [5-14-3] (2) [5-14-4] (3) [5-14-7] 


ADPGVX ADFGVX ADFGVX 



FiacRi ss. 


j. These distributions are now tested for monoalphabeticity, by applying the test. The 
number of occurrences in each distribution is 41. Then 41X40X-066'7=109.4 is the expected 
value of for plain te.\t; 41X40X.0385=63.1 is the expected value of ^ for random text. 
Here are the calculations for the first distribution (combination 5-14-3) yielding the observed 
value of ^ as 82: 

(5X4) + (3X2) + (1X0)4-(2X1) + (1X0) + 

(2X1) + (3X2) + (1X0) + (1X0) + (5X4) + (2X1) + 

(1X0) + (4X3) + (2X1) + (1X0) + (3X2)4-(2X2) + (2X1)=82. 

The observed values of 0 for all 6 frequency distributions are shown herewith: 


(1) =82 (4) = 120 

(2) =76 (5)= 70 

(3) =78 (6) = 110 
























Only two of these distributions give close approximations to 109, the expected value of and 
they may be retained for further experiment. They are the ones for combinations (4) and (6), 
with values of 120 and 110, respectively. 

k. Selecting combinations (4) and (6) viz, 14-5-3, and 14-5-7, since columns 14, 3, 4, 5 and 
7 form the group of 5 columns at the left of the transposition rectangle, the following combina¬ 
tions are possible; 


(1) 14-6-3-4-7 (3) 14-5-7-3-4 

(2) 14-5-3-7-4 (4) 14-5-7-4-3 


1. The following sets of columns correspond to these 4 combinations in the 2 cryptograms 
(fig. 56): 


No. 3 


(1) (2) (3) (4) 


14 8 3 4 7 14 5 3 7 4 

1 ADDFD ADDDF 

2 ADVDF ADVFD 

3 AAFXF AAFFX 

4 FGDAG FGDGA 

5 DDFXD DDFDX 

6 AGXVX AGXXV 

7 DXAAD DXADA 

8 AAGDV AAGVD 

9 DVFXD DVFDX 

10 XGXFA XGXAF 

11 VDAXD VDADX 

12 VGFFA VGFAF 

13 AAADV AAAVD 

14 XDFGD XDFDG 

15 FAAAA FAAAA 

16 VFXGD VFXDG 

17 AADFD AADDF 

18 DXDGD DXDDG 

19 DFDGG DFDGG 

20 GADAA GADAA 


14 8 7 3 4 14 8 7 4 3 

ADDDF ADDFD 
ADFVD ADFDV 

AAFFX AAFXF 

FGGDA FGGAD 

DDDFX DDDXF 

AGXXV AGXVX 

DXDAA DXDAA 

AAVGD AAVDG 

DVDFX DVDXF 

XGAXF XGAFX 

VDDAX VDDXA 

VGAFF VGAFF 

AAVAD AAVDA 

XDDFG XDDGF 

FAAAA FAAAA 

VFDXG VFDGX 

AADDF AADFD 

DXDDG DXDGD 

DFGDG DFGGD 

GAADA GAAAD 
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(3) [14-5-7-3-4] 

A D F G V X 
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(4) [14-5-7-4-3] 

A D F G V X 


A 


nil 


n 
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III 
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II 
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III 

III 
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II 

III 


nil 
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nil 
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III 


~\ 


1 
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n 

1 

1 
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X 


1 

1 
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n. Again applying the 0-test, the expected value of 0 is 81X80X.0667=432. The observed 
values for the four combinations of figure 57 are as follows: 

(1) For combination 14-5-3-4-7, 0=436 

(2) For combination 14-5-3-7-4, 0=276 

(3) For combination 14-5-7-3-4, 0=344 

(4) For combination 14-5-7-4-3, 0=318 

The combination 14-5-3-4-7, giving the greatest value for 0 (a little better than the expected 
value), is very probably the correct one. 

0 . F.Yw.T inining the other cryptograms that are available, it is seen that No. 7 is the third 
longest one of the entire set, with 124 letters; moreover, the dimensions of the rectangle [(15X9)— 
11 = 124] are such as to bring about 4 long columns of 9 letters and 11 columns of 8 letters. The 
first 5 columns are definitely fixed in position, since it is known that the first 5 key numbers are 
14-5-3-4-7. The resulting diagram is shown in figure 58. There is now a section consisting of 
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10 columns which are to be anagranuned to ascertain their correct sequence. The column to 
follow column 7 is ascertained on the basis of the repetitions which are brought about when the 
selected column is placed on the right. These repetitions should fall into those cells of frequency 
distribution (1), figure 57, which are of high frequency. In other words, the process is one of 
selecting from among columns 1, 2, 6, 8, 9, 10, 11, 12, 13, and 15 that colunm which will yield 
the most repetitions of bipartite digraphs with the digraphs given by the juxtaposition of columns 
14-5-3-4-7, as distributed in frequency square (1) of figure 57. The column thus selected turns 
out to be No. 10. Then other columns are added by proceeding along the same lines, the work 
becoming progressively more easy as the number of available candidates decreases. Sometimes 
the discovery of what appears to be a long repetition within one of the cryptograms or between 
two cryptograms facilitates the process. In this case the results obtained from the 3 crypto¬ 
grams under study are shown in figure 69. 


14 8 8 4 _ 7 10 

AD D F D X 

AD V D F D 

A A F X F V 

F G DA G F 

D D F X D F 

AG XV X F 
D X A A D F 

A A G D V D 

D V F X D X 

X G X F AG 

V D AX D V 

V G F F AG 

A A AD V D 

X D F G D F 

FA A A AG 

V F X G DA 

A A D F D V 

D X D G DA 

D F D G G D 

G A DA A 


No. 3 

IS 12 13 1 3 8 

A A F X D D 

F G F D X A 

FA A A AG 

F F A A A A 

G D FA A A 

X G D G G A 

AX G X D F 

X A AD F G 

D F G D AG 

FA AX D D 
D F F V G X 

D X V F A A 

F X X F F X 

X G D V D F 

AG G D AG 

A A G G D V 

AG FA G X 

A A G D V D 

A A D F G D 


6 9 


A G 
G D 

V D 
A F 
A A 
G F 
A A 
F G 
D V 

V A 
D F 

V G 
D X 
X G 
F V 
D D 
A D 
X A 
F X 


11 

A 

X 

D 

A 

F 

A 

A 

F 

D 

G 

F 

V 

F 

X 

X 

X 

A 

A 

G 


FtavRI 69. 











p. What the cryptanalyst now has before him is a monoalphabctic substitution cipher, the 
solution of which presents no difficulties. The cipher square is reconstructed as completely as 
possible, blanks being left where there are no occun-ences to give clues as to the character involved, 
usually some of the digits and the very infrequent letters. In this case the only letters which do 
not occur in the plain text are Q, X, and Z. The digits 5 and 7 are recovered from the context, 
in message No. 6, where the caliber of a gun is mentioned and the digits are confirmed at othar 
places in the message. The square that is obtained is seen in figure 60. Examination of the 
mixed sequence discloses that it is based upon the phrase THE FLOWERS THAT BLOOM IN THE 
SPRING. This permits of the establishment of the transposition key and of the position of the 
digits in the checkerboard (as in par. .38 t). The results are shown in figure 61. The completdy 
solved messages are shown in figure 62. 


.. 















































122 


No. 6 


14 5 3 4 




Ifi 12 


13 1 



6 2 11 

H 0 


S 


T 


I 


L 

E T 

AD D F 


D X 


A A 


F X 


D D 

AG A 

R 

0 


0 


P 


S 


E S 

AD V D 


F D 


F G 


F D 


X A 

G D X 

T I 


M 


A 


T 


E 

D 0 

A A F X 


F V 


F A 


A A 


A G 

V D D 

N 

E 


B 


A 


T 


T A 

F G DA 


G F 


F F 


A A 


A A 

A F A 

L I 


0 


N 


M 


0 

V I 

D D F X 


D F 


G D 


F V 


D F 

X F F 

N 

G 


U 


P 


S 


T R 

X G D G 


G X 


D G 


F D 


X A 

AD V 

E A 


M 


L 


I 


N 

E S 

AG FA 


F V 


D D 


F X 


G D 

AG D 

0 

U 


T 


H 


W 


E S 

X D F X 


D A 


A A 


D D 


G A 

G D X 

T 0 


F 


R 


J 


5 

7 7 

A A D F 


A X 


D V 


V G 


A V 

G V G 

H 

A 


N 


D 


A 


S S 

V A D F 


A G 


D V 


D F 


A D 

X D X 

E M 


B 


L 


I 


N 

G I 

AG F V 


F F 


D D 


F X 


G D 

G G F 

N 

W 


0 


0 


D 


S N 

X G D D 


G D 


F D 


F V 


D D 

X G D 

0 R 


T 


H 


E 


A 

S T 

D F D V 


A A 


A D 


A G 


F A 

D X A 

0 

F 


G 


0 


L 


D E 

AD FA 
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G D 


F D 


D V 

DA G 

N V 


I 


L 


L 


E 

S T 

G D X F 


F X 


D D 


D D 


A G 

D X A 

0 

P 


B 


A 


T 


T E 

AD F G 


F F 


F F 


A A 


A A 

A A G 

R Y 


0 


F 


7 


5 

S F 

D V XV 


D F 


A X 


G V 


A V 

D X A 

I 

R 


I 


N 


G 


F R 

X F X D 


V F 


X G 


D G 


G A 

X D V 

0 M 


0 


R 


C 


H 

A R 

D F F V 


D F 


D V 


G X 


A D 

FA D 

D 

L 


E 


E 


F 


A R 

V V D D 


D A 


G A 


G A 


X F 

AD V 


M 

F V 
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No. 7 


F R 0 N T L I N 

AXDVDFGDAADDFXG f 

E 0 U T P 0 S 

DA GD FX DA AG FD FD X 

TREPORTS 
AA DV AG GF DF DV AA D 

0 U R I N F A 

XD FX DD VF XG DA XF A 

NTRYMISS 
GD AA DV XV FV FX DX D 

I 0 N S S H 0 

XF XD FG DD XD XA DD F 

TDOWNINE I 

AAVDDFDGGDFXGDA ; 

N E M Y L I N I 

GGDAGFVXVDDFXGD 

E S i ' 

A G D X I 

No. 8 

4 6 8 4 7 10 15 12 IS 1 2 8 6 » 11 

“If I R E L 1 N E i 

DGFXDVAGDDFXGDA i, 

TOBRIGA 

GAADFFFDVFXGGFA 

din'terru I' 

VDFXGDAAAGDVDVX "I 

P T E D 

DGFAAAGVD 

Fiodbi 62— Continued. ! 

40. Special solution by the exact factor method.—o. The student who has comprehended 
the successiTe steps in the solution of the example discussed in the preceding paragraph is in a 
position to grasp at once the mechanics of the special solution by the exact factor method. The 
latter is based upon the interception of a number of cryptograms, preferably lengthy ones, which 
have been enciphered by rectangles in which the last row is completely filled with letters. The | 

total number of bipartite components in the case of such a cryptogram will yield clues as to the i 

dimensions of the transposition rectangle. Then the text is transcribed into columns of appro¬ 
priate length, aU being equal in this respect, and the process of combining columns, as explained I 

in paragraph 39e, is applied in order to produce the best monoalphabetic distribution of bipartite | 
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digraphs down the juxtaposed columns. There is nothing to prevent the simultaneous use of 
aU cryptograms that have been enciphered by completely filled rectangles, for it is clear that 
if, for example, columns 15 and 4 are to be paired in one cryptogram, the same columns will be 
paired in all the other cryptograms. Hence, even if the rectangles are small in depth they can 
be used in this process; it is necessary only that all colmnns of any rectangle be of the same 
length. Now if only two or three such pairs of columns can be set up correctly, solution follows 
almost as a matter of course. No additional or new principles need be brought into play, beyond 
those already possessed by the student. 

h. In this special solution, the important step is, of course, the initial one of experimenting 
with rectangles of various dimensions until the correct size has been hit upon. In some cases, 
excessive experimentation may not be necessary if the total number of characters is such as to 
yield only one or two possibilities with regard to the length of the columns. For example, suppose 
that previous work has established the fact that the enemy uses transposition rectangles not 
less than 15 and not more than 22 columns in width. A message totaling 703 letters would 
indicate a rectangle of 19 columns of 37 letters, since these two numbers are the only factors of 
703. If this then were corroborated by other cryptograms of 76 (19X4), 152 (19X8), 190 
(19X10) letters, the probability that 19 is the width of the transposition rectangle becomes quite 
persuasive. Of course, there will be and there should be other cryptograms of lengths that do 
not factor exactly; these represent the ones in which the rectangles are not completely filled in 
their last row. They do not enter into the solution at first, but just as soon as the positions of 
two or three key numbers become fixed, the data afforded by these messages become available 
for use in tlie later stages in the solution. 

c. The exact-factor method is a useful one to know. For despite all instructions that 
may bo drawn up insisting upon the advisability of not completing the last row of a transposition 
rectangle, the tendency to violate such a rule is quite marked, especially where a large ciypto- 
graphic personnel must be employed. It is not astonishing to find that for lazy or ignorant clerks 
the temptation to fill the rectangle completely is particularly hard to resist when it happens that 
a message falls just one, two, or three letters short of forming a completely-filled rectangle: 
it is so much easier for such clerks to handle a rectangle with equal-length columns than one in 
which this is not the case. Moreover, the number of errors and therefore the number of times a 
shiftless or careless clerk must go over his work to correct errors is reduced to a minimum . 
Hence, it often happens that in such cases an enciphering clerk adds one, two, or three letters 
to complete the last row, thus leading to the transmission of not a few cryptograms enciphered 
by completely-filled rectangles. Space forbids giving an example of such a solution. 

41. General solution for the ADFGVX system.—a. All three of the foregoing methods of 
solving cryptograms in the ADFGVX system fall in the category of special solutions and therefore 
are dependent upon the fortuitous existence of the special conditions required under each case. 
What is really desired in the practical situation is a method of solution which is not so dependent 
upon chance or good fortune for success. A search for a general solution was, of course, made 
during the time that the system was under minute study by the ciyptanalytic agencies of the 
Allies, but no general solution was devised. All the solutions made during actual hostilities 
and for a number of weeks thereafter were of the special types described in the preceding para¬ 
graphs. The first pubUshed description of a general solution is to be found in Givierge’s Cours 
de Oryptographie, 1925, but only in broad outlines. A complete general solution was inde¬ 
pendently conceived by a group of cryptanalysts in the office of the Chief Signal Officer * and 
will be described in paragraphs 42 and 43. 

b. The attention of the student is directed to the comments made in paragraph 18, with 
regard to the significance of the term general solvUon in cryptanalysis. He must be cautioned 

* See footnote 7 of this section. 
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not to expect that in practical work a general solution will, in the cryptanalytic as in the mathe¬ 
matical field, invariably lead to a solution. If there is a sufficient amount of text and if the text 
contains no abnormalities, the attempt to apply the general solution will usually be successful. 
But the cryptanalyst must remember that the ADFGVX system is by no means a simple one to 
solve even under the best of conditions and if there is only a small amount of text, if it happens 
that the transposition key is unusually long, or if the text is abnormal, he may not succeed in 
solving the messages by the straightforward method to be set forth below, and he may have to 
introduce special modificatious. For the latter he can only rely upon his own ingenuity and 
intuition. 

42. Basic principles of the general solution.— a. Every transposition rectangle in the 
ADFGVX system must conform to one or the other of two and only two fundamental types: the 
number of columns must be either odd or even. A number of important consequences follow from 
t.hig simple fact, some of which have already been pointed out in paragraph 39e. They will be 
elaborated upon in the next subparagraphs. 

h. Consider a rectangle with an even number of colmnns. Each of its rows contains an 
even number of bipartite components, half of which are inilial components, half, final compo¬ 
nents, alternating in a regular order from left to right in the rows. When the transposition is 
applied, all the components within a given column are of the same class, either initial or final. 
No intermixture or alternation of the two classes is possible. On the other hand, consider a 
rectangle with an odd number of columns. Each of its rows contains an odd number of bipartite 
components, the 1st row containing one more initial component than final components, the 2d 
row containing one more final component than initial components, and so on, this arrangement 
alternating regularly in the successive rows of the rectangle. When one studies the various 
columns of the rectangle, it is seen that in each column there is a perfectly regular alternation of 
initial and final components, the odd columns (Ist, 3d, 6th, . . .) beginning with an initial 
component, the even colmnns (2d, 4th, 6th, . . .) beginning with a final component. This 
alternation in components remains true even after the transposition is applied. These remarks 
become very clear if one studies figure 63. Two transposition rectangles are shown, one with 
an even nmnber of columns, the other with an odd number. Instead of the actual components 
(ADFGVX), the symbols 0i and 02 are used to indicate the two classes of components, initial and 
final, because in this analysis interest centers not upon the actual identity of a component but 
upon the class to which it belongs, initial or final. At the top of each column is placed a “plus” 
to denote a column occupying an odd-numbered position in the rectangle, or a “minus” to denote 
a column occupying an even-numbered position. 

Even Number of Columm'b Odd Number of CoDUMKa 

+ — -f — -1- — -f — + — + — + — + — + — + 


0 , 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 

01 02 01 02 01 02 01 02 01 02 02 01 02 01 02 01 02 01 02 

01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 

a b 

FIOUBX 63. 

c. In what follows, the term “odd column” will mean merely that the jcolumn in question 
occupies an odd position (1st, 3d> 5th, . . .) in the transposition rectangle; the term “even 
column,” that it occupies an even position (2d, 4th, 6th, . . .) in the rectangle. The odd or 
even designation has no reference whatever to the nature of the transposition key nmnber appli¬ 
cable to that column, whether it is odd or even. Now when the transposition is applied to the 
even-width rectangle o, figure 63, the cryptographic text will consist of a nmnber of sections of 
letters, each section corresponding to a column of the rectangle, and therefore the number of 

324156—11-9 
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Sections in this case will be even. Moreover, all the components in a section corresponding to 
an odd column in rectangle a will be 0i or initial components, all those in a section corresponding to 
an even column, G* or final components. The sections or columns are completely homogeneous with 
respect to the class to which their constituent components belong. On the other hand, when the 
transposition is applied to odd-width rectangle b, the cryptographic text will consist of an odd 
number of sections, each corresponding to a col umn of the rectangle. The components in the 
sections consist of members of both classes of components in a regular alternation; in a section 
corresponding to an odd column the order is 0i-»ea-»0i . . .; in a section corresponding to an 
even column the order is Gj—»0i—»0j . . .. The sections or columns are not homogeneous in this 
case as they are in the former. 

d. Now if there were some way of distinguishing between initial components as a class and 
final components as a class it is clear that it may be possible first of all to ascertain whether the 
transposition rectangle contains an even or an odd number of colunms. Secondly it may be 
possible to identify those columns which are even and those which are odd. Finally, it ma y be 
possible to ascertain which are the long columns and which are short, thus yielding the exact 
outlines of the rectangle in case the last row is incompletely filled. From that point on, solution 
follows along the same lines as explained in paragraph 40, with the modification that in the pair¬ 
ing of columns the nmnber of possibilities is greatly reduced, since it is useless to pair two columns 
both containing initial components or final components. 

e. The foregoing depends then upon the possibihty of being able to distinguish as a class 
between initial and final components of the bipartite cipher equivalents in this system, or at 
least between letters belonging to one or the other of these two general classes of components. 
Now if the substitution checkerboard has not been consciously manipulated with a view to 
destroying certain properties normally characterizing its rows and columns, the sort of differenti¬ 
ation indicated above is quite possible. For example, if in the checkerboard shown in figure 61 
the normal frequencies of the letters as they appear in English telegraphic plain text * are inserted 
in the cells and totals are obtained vertically and horizontally, these totals will permit of assign¬ 
ing frequency weights to the letters ADFGVX as initial and as final letters of the bipartite cipher 
equivalents of the plain-text letters. This is shown below in figure 64. The bipartite letter A 


2d Component 



A 

D 

F 

G 

V 

X 

Sums 

A 

"t" 

“h” 


“e“ 


~ 




34 


130 


28 

284 

D 


L 

0 

w 

R 

S 



36 

76 

16 

76 

61 

264 

F 

A 


B 


M 

I 



74 


10 


26 

74 

183 

IST COMfONENT 

G 


N 

p 

G 


c 




79 

27 

16 


31 

163 

V 


D. 


J 


K 




42 


2 


3 

47 

X 

T” 

u 

V 

X 

Y 

z 



3 

26 

16 

6 

19 

1 

69 

Sums 

169 

217 

127 

169 

120 

198 

1.000 


Fiodhe 64. 


* As given in fig. 3, p. 13, Military Cryptanalysis, Part 1. 
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has a frequency value of 284 as an initial component of the bipartite cipher equivalents of plain¬ 
text letters, and a frequency value of only 169 as a final component. 

Similarly, the letters V and X have frequency values of 47 and 69, respectively, as initial com¬ 
ponents and 120 and 198 as final components. It is obvious, then, that in this checkerboard the 
weighted frequency values of the letters A, V, and X as initial components differ considerably from 
the values of these same letters as final components, the value for G as an initial is only a little 
less than its value as a final, the values of D and F as initials are only a little more than their 
values as finals. But it is the wide variations in the weighted frequency values of certain of the 
letters as initial components and as final components, exemplified in the case of A, V, and X, 
which form the basis of the general solution, because these wide variations afford a means for 
making the various differentiations noted in subparagraph d. 

/. Of course, in working with an unknown example, the composition of the checkerboard is 
imknown and therefore no accurate frequency weights may be assigned to the ADFGVX com¬ 
ponents in the cryptograms. However, it is still possible to arrive at some approximations for 
these weights in case there are several cryptograms available for study, as would normally be 
true in actual practice. How this can be done will be shown very soon, by studying an example. 
For the purposes of this study the set of 12 cryptograms given below will be used. 


I 


V 

D 

D 

G 

G 

G 

V 

F 

D F V D 

V V 

F 

V 

D 

G 

A 

D 

D 

A 

F 

F 

F 

V 

D 

X 

F 

D 

D 

X 

D 

V X AD 

V D 

V 

F 

X 

G 

D 

F 

V 

A 

D 

D 

G 

D 

G 

D 

G 

V 

G 

D 

D 

D F X F 

A D 

A 

V 

D 

V 

G 

D 

G 

A 

D 

X 

V 

D 

A 

D 

A 

D 

F 

X 

A 

V F V D 

D A 

A 

V 

D 

F 

F 

D 

F 

V 

G 

D 

F 

V 

D 

D 

G 

V 

D 

D 

D 

D A V A 

D A 

F 

A 

D 

D 

X 

A 

D 

D 

G 

A 

D 

F 

V 

G 

F 

V 

D 

G 

A 

D V F X 

V X 

D 

G 

D 

D 

A 

G 

G 

D 

D 

X 

F 

F 

D 

D 

X 

A 

D 

F 

G 

DA G X 

D D 

A 

V 

F 

D 

A 

F 

G 

V 

F 

V 

F 

A 

F 

F 

V 

F 

A 

F 

X 

G F X D 

G V 

A 

D 

F 

V 

D 

G 

G 

A 

V 

G 

G 

D 

D 

G 

D 

V 

X 

A 

X 

F D D X 

(212 letters) 


















II 












V 

D 

A 

A 

V 

D 

D 

F 

X F X D 

D A 

X 

G 

X 

F 

X 

D 

D 

F 

X 

A 

D 

V 

A 

G 

D 

D 

F 

A 

X 

D V A V 

D V 

D 

D 

F 

V 

F 

V 

F 

F 

G 

D 

G 

F 

V 

A 

X 

V 

X 

A 

V 

G D V D 

X F 

D 

X 

D 

G 

A 

X 

G 

F 

G 

G 

F 

V 

F 

G 

D 

F 

V 

D 

X 

A V X D 

D V 

G 

D 

D 

V 

G 

V 

A 

G 

F 

X 

F 

A 

A 

A 

X 

D 

D 

X 

G 

(108 letters) 





















III 












D 

A 

G 

A 

A 

F 

G 

A 

G V D A F G 

G 

X 

F 

D 

X 

D 

F 

V 

V 

X 

G 

F 

X 

F 

D 

X 

D 

D 

A 

G A D D G V 

A 

D 

D 

V 

D 

D 

G 

A 

F 

G 

A 

V 

G 

D 

G 

X 

D 

D 

D 

A V F V D D 

F 

D 

A 

A 

A 

A 

D 

X 

A 

G 

D 

X 

A 

G 

G 

D 

D 

A 

V 

G V F G 

D V 

F 

V 

D 

G 

G 

X 

G 

G 

A 

F 

F 

V 

F 

D 

A 

X 

G 

D 

D 

D G D A F D 

A 

D 

G 

G 

A 

D 

D 

G 

D 

X 

A 

F 

V 

D 

F 

D 

X 

F 

V 

G D D V A V 

F 

D 

D 

D 

V 

F 

A 

G 

D 

F 

F 

F 

X 

A 

A 

D 

F 

A 

D 

G G V F D A 

V 

D 

G 

X 

F 

V 

D 

A 

A 

V 

G 

D 

X 

F 

G 

G 

D 

D 

X 

G D A (186 letters) 
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IV 











A D 

X 

V 

F 

X 

V 

G 

G 

V 

F D D V A 

F 

G 

A 

A 

V 

F 

D 

G 

V 

D 

D D 

G 

D 

G 

F 

D 

V 

V 

A 

F G X F X 

F 

D 

D 

D 

D 

V 

G 

D 

A 

X 

D A 

X 

D 

D 

D 

A 

G 

V 

F 

F A A D V 

G 

D 

F 

X 

G 

X 

G 

V 

G 

D 

D D 

D 

A 

D 

V 

X 

V 

F 

A 

V D A X X 

D 

F 

A 

A 

F 

A 

V 

D 

V 

G 

V D 

V 

D 

D 

A 

X 

D 

A 

A 

(110 letters) 












V 


D F 

X 

F 

D 

D 

V 

V 

V 

D 

X 

F 

X F 

X 

F 

F 

F 

V 

A 

G 

F D 

X 

A 

V D 

A 

G 

F 

D 

V 

D 

G 

F 

A 

D 

A A 

D 

F 

D 

V 

F 

G 

D 

A D 

F 

V 

F V 

F 

X 

G 

X 

D 

D 

A 

G 

D 

V 

G V 

F 

D 

G 

X 

X 

D 

F 

F G 

D 

G 

X G 

V 

D 

D 

V 

D 

D 

F 

G 

F 

V 

G D 

D 

V 

F 

V 

A 

G 

X 

X D 

F 

V 

D X 

A 

V 

F 

G 

A 

G 

A 

G 

A 

X 

D V 

D 

F 

X 

G 

V 

G 

D 

A D 

D 

X 

A G 

X 

D 

A 

D 

F 

D 

G 

X 

F 

D 

G G 

F 

V 

G 

X 

V 

V 

G 

D D 

D 

A 

G X 

V 

D 

G 

V 

D 

V 

G 

X 

D 

D 

F D 

D 

V 

A 

G 

A 

A 

D 

G D 

D 

F 

D G 

A 

G 

D 

F 

D 

D 

D 

D 

X 

G 

V G 

V 

G 

G 

G 

D 

G 

X 

D F 

G 

F 

A D 

(202 letters) 




























VI 











G D 

G 

F 

X 

A 

G 

V 

F 

V 

D 

D 

X G 

X 

D 

V 

D 

D 

A 

X 

D A 

A 

X 

F A 

G 

V 

G 

D 

X 

F 

F 

V 

X 

F 

A D 

G 

F 

F 

D 

X 

A 

A 

F V 

X 

F 

D F 

X 

F 

V 

G 

D 

G 

F 

X 

F 

D 

V V 

X 

V 

G 

D 

F 

V 

D 

D V 

F 

D 

F V 

V 

D 

V 

D 

G 

G 

V 

F 

X 

F 

G V 

X 

F 

F 

V 

G 

V 

D 

D G 

D 

D 

D D 

G 

D 

D 

A 

V 

G 

V 

X 

G 

A 

F F 

X 

F 

V 

D 

D 

D 

(120 letters) 











VII 











G A 

F 

G 

F 

F 

X 

F 

V 

F 

G 

F 

X A 

V 

A 

G 

G 

X 

D 

X 

X D 

D 

F 

A G 

V 

D 

D 

V 

D 

V 

F 

F 

A 

D 

A V 

A 

V 

F 

V 

G 

G 

A 

D A 

A 

F 

V F 

D 

F 

V 

D 

X 

F 

X 

X 

G 

D 

X D 

D 

F 

V 

D 

F 

F 

X 

D V 

F 

X 

V A 

D 

X 

V 

A 

X 

D 

V 

X 

A 

F 

F V 

D 

F 

D 

G 

X 

F 

D 

G F 

D 

D 

F V 

D 

V 

V 

A 

A 

F 

V 

F 

F 

V 

X D 

G 

F 

D 

D 

V 

A 

D 

D F 

D 

D 

D X 

F 

F 

A 

G 

F 

X 

F 

X 

A 

A 

G V 

D 

G 

G 

V 

D 

F 

G 

G G 

X 

D 

F D 

F 

V 

A 

F 

F 

G 

F 

X 

G 

D 

A X 

D 

G 

D 

G 

G 

D 

D 

A V 

D 

X 

A D 

F 

A 

F 

V 

F 

X 

D 

D 

X 

V 

A G 

D 

V 

V 

D 

D 

F 

X 

D G 

X 

X 

D V 

F 

V 

F 

D 

D 

D 

D 

A 

A 

F 

D F 

X 

D 

X 

G 

D 

A 

A 

F V 

D 

F 

D V 

D 

D 

V 

A 

D 

D 

V 

D 

V 

A 

V D 

G 

A 

F 

V 

F 

X 

F 

A A 

V 

D 

D F 

V 

D 

(254 letters) 

























VIII 











D G 

V 

V 

G 

F 

X 

G 

G 

G 

A 

D 

F A 

F 

V 

V 

V 

A 

X 

A 

V G 

G 

V 

V D 

V 

G 

V 

V 

D 

A 

V 

G 

D 

G 

D G 

A 

V 

F 

D 

D 

A 

D 

D D 

X 

X 

D X 

F 

V 

F 

X 

G 

V 

G 

G 

D 

G 

D F 

G 

G 

D 

A 

D 

F 

D 

D X 

A 

V 

F D 

D 

V 

F 

A 

D 

X 

G 

D 

A 

D 

G V 

A 

F 

F 

X 

A 

D 

F 

A D 

X 

D 

G F 

A 

D 

F 

D 

D 

G 

V 

D 

V 

X 

A V 

A 

D 

D 

X 

F 

F 

A 

G D 

X 

F 

F V 

F 

G 

F 

G 

F 

D 

F 

D 

V 

D 

X X 

D 

D 

G 

G 

D 

(144 letters) 
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IX 


X 

V 

G V D 

V D 

A V 

G 

A 

V 

F F G 

V A 

D D 

D 

G 

X 

X A A 

A V 

A D 

A 

A 

V 

G G V 

F X 

D A 

F 

D 

V 

D F X 

D V 

D G 

F 

A 

X 

F V G 

D D 

D A 

G 

G 

G 

D A V 

D A 

G G 

F 

D 

F 

(182 letters) 




G 0 D D D 
G F A G X 
X A V V D 
G V F X A 
A V V G D 
A D A G D 
G X F V D 
A X X A D 


D G D D F 
D V V X D 
F X F D X 
D A A G G 
D A X G V 
G X D G A 


V F D D V 
F D D X G 
D A A A G 
D F G A F 
F D X G D 
G V D G A 
G V D X D 

V D X D D 


X F D F X 
F D A A D 
D G D V V 
G D D F A 
D V X A D 
V G D A G 
X G F V A 
D D A G A 
D F F D A 
(224 letters) 


V F A V D 

D F D D V 

V D A A D 

F A X G V 

V V D A A 

(130 letters) 


A X G D A 
G A V G A 

V A V F G 
D F V D D 
F D G F D 

V G V D F 
F F F X G 
X F V D D 


V V D V D 
X A D F V 
A V V V F 
X D D G X 

V A V A V 
F X D D F 

V F A G G 
A G X F G 
A D V D D 


X 

V F D A D 
G X G V D 
D F X D D 
X X F X A 
G G V F G 


XI 


XII 

A V D A D 
G V D G F 
A D D A X 
G V F X A 
G V D D D 
A D V X V 
D A V V D 
D D D G V 
X G D F D 


F G D F V 
A X X A X 
D G X D V 
D G V G A 

V A A G D 

V A V F G 
D A X D X 


G F V G V 
X G V G D 
A F F A A 
D G D F D 
V A V F V 


V F A G D 
X F G D V 
A V F V A 

V X V F D 
A F D F A 
D F X F F 
X D X G D 
F G F V G 
D V D D G 


D V A V D 
D G A D G 
G D D D D 
F G D D F 
X F D V A 
X X F D D 
F F V G F 


G G D F V 
X D G D X 
F V F A G 
G X G D A 
A A G A X 


F X X D A 
G A F A F 
F V D D A 
F X X X F 
G A D X D 

V F V V D 

V V X G F 


G V A D D 
F V D D D 
D A X D V 
G D X D F 
D V F F V 

V V G F X 
D V V A D 

V X G V F 
A F G D 


DFGGG GFGDD 
GDVDF DFDDD 
GVADD GDDFG 
FVVVA DAGDX 
DFGDA GFAAG 
DDFXG AGXFG 
XGXAG AGVGD 
X (186 letters) 


43. Illustration of solution.’'— a. Since the initial letters of all 12 crjrptograms are in the 
same class, that is, either initial or final components, they may aU be combined into a single 
distribution. Furthermore, since it is certain that regardless of whether the transposition rectangle 
has an odd or an even number of columns the 3d, 5th, 7th . . . letters of the cryptograms are in 


* This illustration uses the same cryptograms and follows quite closely along the lines employed in a tech¬ 
nical paper of the Signal Intelligence Service entitled General Saiuiion for the ADFQVX Cipher, prepared by 
Messrs. Eowlett, Kullback, and Sinkov, in 1934, 
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the same class as the first letter, the 3d, 5th, 7th .. . letters may be added to the distribution, 
so long as these odd letters come from the same section (column 1). It is, however, necessary 
to limit the number of letters taken from the beginning of any one cryptogram to a reasonable 
length of column, depending on the size of the cryptogram. Assuming it is known that the 
enemy is using transposition keys of not less than 15 nor more than 22 numbers, the latter could 
be taken as the TnnyiTm im possible size. But to be on the safe side it will be here assumed that 
a transposition rectangle of not more than 25 coliunns is beii^ used. Hence, so far as concerns 
cryptogram I, which has 212 letters, on the basis of a key of 25 numbers [(25X9) —13=212] 
there will be 12 columns of 9 letters and 13 columns of 8 letters. Since there is no way of telling 
which are loi^ and which are short columns, it will be safer to work on the basis of columns of 
8 letters. Therefore, the first 8 letters of cryptogram I are to be taken. In the case of crypto¬ 
gram II, with 108 letters, its first 4 letters will be taken, and so on, through the 12 cryptograms, 
the number of letters to be taken in each case being governed by the length of the cryptogram. 
The sections taken in the case of the 12 cryptograms are shown in figure 65. 



b. The odd and the even letters of these 12 sections are then distributed separately, the 
results being shown in figures 66 and 67. A consideration of the mechanics of this system leads 
to the expectation that if the transposition rectangle has an even number of columns the two distri¬ 
butions vM be similar; if it has an odd number, they wiU be different. The similarity or difference 
between the two distributions is usually discernible with as few as 20 or 25 letters. 

Odd (Ist, 3d, . . .) letters Even (2d, 4th, . . .) letters 

ADFGVX ADFGVX 

f ’Hi f r * ^ fn "" "" ' 

Figubi 86. Fiogbb 67. 

c. Letters V and X are of high frequency in the odd positions (fig. 66) but of low frequency 
in the even positions (fig. 67), whereas the letter F is of low frequency in the odd positions and of 
high frequency in the even positions. There can be no question that the two distributions are 
dissimilar, and the indications are clear that the transposition rectangle involves an odd number 
of columns. 

d. Now the letters in figure 66 may be initial components, those in figure 67, final com¬ 
ponents, or the reverse may be the case. At the present stage of the study it is impossible to 
ascertain which of these alternative hypotheses is correct. However, this information is really 
immaterial at this stage. Suppose the letters in figure 66 are arbitrarily designated as class 1 
components, those in figure 67 as class 2 components. Class 1 components (fig. 66) are charac¬ 
terized by a predominance of V’s and X’s (over their frequencies in fig. 67); class 2 components 
(%. 67) are characterized by a predominance of F’s (over its frequency in fig. 66). 
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e. The two distributions in figures 66 and 67 apply to the letters which come from column 1 
of the transposition rectangles for the 12 cryptograms understudy. In this column, the V’s and 
X’s fall predominantly in the odd positions, the F’s fall predominantly in the even positions. 
Therefore, beginning with position 1, the components in this column show an alternation of the 
type ei-> 0a-> ©i. By referring to figure 63 it will become clear that if class 1 components are 
initial components, then it must follow that column 1 occupies an odd position in the transpo¬ 
sition rbctangle; but if class 1 components are final components, then it must follow that column 
1 occupies an even position in the transposition rectangle. Which of these alternatives is true 
cannot be ascertained at the moment. But the important point to be noted is that a definite reversal 
in the type of alternation of class 1 and class 2 components indicates the transit, in the transposition, 
from the end of one column to the beginning of the next column. That is, if it is found that from the 
beginning of the cryptogram the alternation of components is 0i-> 0j-» 0i and after a number 
of letters this alternation changes to ©*-> 0i-» 0g, the point where this change occurs marks the 
end of col umn 1 and the beginning of the column 2. For the sake of brevity in reference, in the 
subsequent paragraphs the type of alternation ©i-» 0j-> 0i will be designated as the “ -1- type,” 
and this type of alternation characterizes columns which fall in the odd positions in the trans- 
jTOsition rectangle i. e., in the 1"*, 3“, 5“*, 7*"*, . . . positions from the left. The other type, 
0»-»0i-^0a will be designated as the “ — type,” and this type of alternation characterizes columns 
which fall in the even positions in the transposition rectangle i. e., in the 2“, 4*“, 6**’, 8“*, . . . 
positions from the left. 

f. With these principles in mind, let cryptograms III and XI, each containing 186 letters, be 
studied. They may be superimposed, since they have identical numbers of letters and therefore 
the columns end at exactly the same points in both cryptograms. 



1 

3 

3 

4 

6 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

III. 

D 

A 

G 

A 

A 

F 

G 

A 

G 

V 

D 

A 

F 

G 

G 

X 

F 

D 

X 

D 

F 

V 

V 

XI. 

V 

F 

D 

D 

V 

A 

X 

G 

D 

A 

D 

F 

G 

G 

G 

G 

F 

G 

D 

D 

F 

X 

X 


24 

zi 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

III. 

X 

G 

F 

X 

F 

D 

X 

D 

D 

A 

G 

A 

D 

D 

G 

V 

A 

D 

D 

V 

D 

D 

G 

XI. 

D 

A 

F 

D 

D 

X 

G 

G 

A 

V 

G 

A 

G 

D 

V 

D 

F 

D 

F 

D 

D 

D 

G 


47 

48 

49 

so 
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162 
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m. D A 

XI. D X 


Figvbi 68) 
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g. It has already been noted that beginning with the first letter of any one of the ciypto- 
grams, the type of alternation for column 1 is +. It is therefore not astonishing to find, within 
the first 10 letters, an alternation of the + type. Note how the V’s and X’s fall in the odd posi¬ 
tions, the F's in the even. Thus: 

123456789 10 

III. DAGAAFGAGV 
XI. VFDDVAXGDA 

It is seen that there are 2 V’s which fall in odd positions (1 and 5), but one V falls in an even 
position (10). There is an X, which falls in an odd position (7); there are 2 F’s which faU in even 
positions (2 and 6). Unquestionably, then, the type of alternation, at least for the first 10 
letters in each of these cryptograms, is -f. 

h. Take the next section of 10 letters in these two cryptograms. The letters are as follows: 

11 12 13 14 15 16 17 18 19 20 


III. DAFGGXFDXD 
XI. DFGGGGFGDD 

Here there are 4 F’s; 3 of them fall in odd positions (13, 17, 17), and one falls in an even position 
(12). Thereare2X’s; one falls in an odd position (19), one in an even position (16). Thereareno 
V’s among these letters. So far as the evidence afforded by the F’s is concerned, it would appear 
that this section of text shows the type 2 or “ — type” of alternation of components, since in 
t 3 rpe 1 or “ -f type” the F’s occupy even positions and here the majority of them occupy odd 
positions. But so far as the X’s are concerned, the evidence is equally balanced: one X falls in an 
odd position, one in an even position. There being no V’s, no conclusions can be drawn from this 
letter. To be guided solely by the evidence afforded by the 3 F’s may be unwarranted. Is it 
not possible to weight the frequencies of the letters so that it will be unnecessary to rely merely 
upon a few of them and the evidence afforded by all the letters can be taken into account? Why 
not assign frequency weights according to the two distributions in figures 66 and 67? The figures 
then become as follows: 

Odd (Ist, 3d,. . .) letters Even (2d, 4th,. . .) letters 

A D F G V X A D F G V X 


Tfltsl-S +11+3 + 8+11+ 6-421etters Total=4 +10+11+5 + 4 + l=3SIfltters 

Figobe 69. 

Since the odd letters have a total frequency of 42, the even, a total frequency of 35, for purposes 
of equalizing the distributions in applying the weights it seems advisable to deduct one-sixth 
from the total when applying the weights to odd letters. 

i. Now in applying these weights to the letters, it must be borne in mind that since a trans- 
poution rectangle with an odd number of columns is involved, half of the letters are class 1 com¬ 
ponents, the other half are class 2 components. Hence, m finding the frequency value of the 
letters it is necessary to apply the weighted frequencies to alternate letters in the sections, as 
shown in figure 70. 

11 12 13 14 15 16 17 18 19 20 

III. DAFGGXFDXD 
XI. DFGGGGFGDD 


Distribution of odd letters 

A D F G V X 


Distribution of even letters 

A D F G V X 


/- 0 3 


3)401 


I 
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These distributions, when evaluated in accordance with figure 69, yield a total frequency value 
of 126; when evaluated in accordance with figure 69 reversed, yield a total frequency value of 
143. The detailed calculations are as follows: 


On the basis of figure 69 normal (odd letters as 0i’s, even letters as ©j’s): 
0(3)-l-3(ll)-l-3(3)-l-3(8)-b0(ll)-l-l(6)=72 

72 

72 - 6=60 

l(4)-h3(10) + l(ll)-H4(5)-t-0(4)-l-l(l)=66 =66 


Total=126 

On the basis of figure 69 reversed (even letters as 0i’s, odd letters as 02’s): 
1(3)-|-3(11)-M(3) +4(8)+0(ll) + l(6)=77 


0(4)+3(10)+3(11)+3(5)+ 0(4)-|-1(1)=79 =79 

Total=143 

y. Now the frequency sums here obtained (126 vs. 143) indicate that an alternation of the 
type 02 -» 0 i ->02 is in effect, that is, if a beginning is made with position 11, the type of alterna¬ 
tion is Since the type of alternation for the first 10 letters is “-b” and for the second 

10 letters the reversal in alternation would indicate that column 1 of the transposition 

rectangle ends somewhere near the 10th letter. This same sort of reversal takes place after the 
20th letter, as shown by the calculation in figure 71. - 

^l_22_M_J4_J5_26_27^_28_£9_^ 

III. FVVXGFXFDX 
XI. FXXDAFDDXG 


Distribution of odd letters 
A DFGVX 


Distribution of even letters 

_ A D F G V X 

/- 1 2 2 1 1 3 /- 0 2 3 1 1 3 

On the basis of figure 69 normal (odd letters as 0i’s, even letters as Gj’s): 
l(3)-b2(ll)-b 2(3)-t-l(8)-hl(ll)+3(6)=68 


0(4)-b2(10)-l-3(ll)-bl(5)-f- l(4)-f3(l)=65 =65 

Total=122 

On the basis of figure 69 reversed (even letters as 0|’s, odd letters as 02 ’ 8 ): 
0(3)-j-2(ll)+ 3(3)-bl(8)-M(ll)+3(6)=68 

1(4)+2(10)-1-2(11)-1-1(5)+ l(4)-b3(l)=58 =58 

Total=115 
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Beginning with the 21st position, the alternation is of type ei-*0a-»0i; hence it is of the" + ” type. 
Again the reversal in type of alternation occurs in passing from the 2d set of 10 letters to the 3d 
set, and this indicates that colunm 2 of the transposition rectangle ends somewhere near the 20th 
letter. But, fortunately, this time the exact location of the break is definitely indicated: The 
simultaneous appearance of V and X in the sequent positions 22 and 23 leads to the idea that the 
22d letter marks the end of column 2 and the 23d letter marks the beginning of column 3. There is 
nothing of an absolute nature in this point: It is merely an indication based upon probabilities and 
does not constitute a conclusive proof by any means. Now if there is this definite break at the 
end of 22 letters it means that columns 1 and 2 must each contain 11 letters. The calculations 
have heretofore been based upon sections of 10 letters and the results are therefore modified as 
shown in the following calculation: 


First Section (letters 1-11) 


III. DAGAAFGAGVD 
XI. VFDDVAXGDAD 


Distribution of odd letters 
A D F G V X 

^ g 5 = " 


Distribution of even letters 

A D F G V X 

g " = " 


/- 1 6 


Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as 0i’s, even letters as ^’s): 
1(3)+5(11)+ 0(3)+3(8)+2(ll) + l(6)=110 

110-^=92 

5(4)+l(10)+2(ll) + l(5)+ 1(4)+0(1)=61 =61 


Total=153 

On the basis of figure 69 reversed (even letters as @i’s, odd letters as 0a’s): 

5(3) + l(ll)+ 2(3) + l(8) + l(ll)+0(6)=51 

l(4)+6(10)+0(ll)+3(6)+ 2(4) + l(l)-78 -78 

Total=120 

The type of alternation is 0i-»0j-^0i, or 

Second Section (letters 12-22) 

13 IS 14 15 16 17 18 19 20 31 33 

III. AFGGXFDXDFV 
XI. FGGGGFGDDFX 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G V X 

' g 5 
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Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as 0i’s, even letters as 0j’s): 

0(3) + l(ll)+5 (3)+3(8)+0(ll) + l(6)=56 

56-^= 47 
6 

l(4)+3(10) + l(ll)+4(5)+ 1(4)+2(1)=71 =71 

Total=118 

On the basis of figure 69 reversed (even letters as 0i’8, odd letters as Gj’s): 

1(3)+3(11)+ 1(3)+4(8)+ 1(11)+2(6)=94 

94-^= 78 
6 

0(4) + l(10)+5(ll)+3(5)+ 0(4) + l(l)=81 =81 

Total=159 

Since the distribution here b^ns with an even-numbered position (12), and the greatest 
total is obtained on the basis of figure 69 reversed, the type of alternation for the second section 
of 11 letters is therefore again 0i-»0j->0i, or “+”. 

Third Section (letters 23-33) 

23 24 35 26 27 28 29 30 31 33 33 

III. VXGFXFDXDDA 
XI. XDAFDDXGGAV 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G V X 

230223 133102 

Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as 0j’s, even letters as G^'s): 

2(3)+3(11)+ 0(3)+2(8)+2(11)+3(6)=95 

95-_= 79 

1(4)+3(10)+3(11) + 1(5)+ 0(4)+2(l)=74 = 74 

Total=153 

On the basis of figure 69 reversed (even letters as 0i’s, odd letters as 02 's): 

1(3)+3(11)+ 3(3) + l(8)+0(ll)+2(6)=65 „ 

65-f- 84 

2(4)+3(10)+0(11)+2(6)+ 2(4)+3(1)=69 = 59 

Total=113 

Since the best values are obtained on the basis of figure 69 normal, the type of alternation for 
the third action of 11 letters is 0 i-»^ 02 -> 0 i, or “+”. 









m 

k. Now if columns 1 and 2 contain 11 letters, and the total number of letters is 186, the 
transposition rectangle obviously has 17 columns, ^ere being 16 long columns of 11 letters and 
one short colunm of 10 letters [(17X11) —1 = 186]. 

l. There is another cryptogram which also contains but one short column, viz, VII, of 254 
letters [17X15) —1=254]. The columns of this cryptogram contain 4 more letters than the 
corresponding columns of III and XI, Assuming, momentarily, that the last column is the short 
one, cryptogram VII may be added to the superposition of III and XI, provided these sets of 4 
additional letters are accounted for. This has been done in figure 72. In that figure the 4 
extra letters pertaining to cryptogram VII are shown as f alling under the last letters of the col¬ 
umns of ciyptograms III and XI, but this is only an arbitrary placement. It is suflicient to 
place these extra letters in such positions as will make the first one of the series begin in an even 
position. 

m. Since the transposition rectangle is now known to be 17 columns wide, the data in figure 
69 may be enlarged to correspond to this information. For example, whereas in originally 
constructing figure 69 the first column of cryptogram I was assumed to have only 8 letters (to 
correspond to a key of 25 numbers), it may now be extended to a column of 12 letters, and so on. 
The additional portions used to make the distributions in figure 74 are shown underlined in 
figure 73. 
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133 134 13.1 136 187 138 139 140 141 142 148 144 145 146 147 148 149 150 151 152 153 164 

III. VGDDVAVFDDDVFAGDFFFXAA 
XI. VDFDDFXGAGXFGVFVVDGVDX 
VII. V FXDDXVAGDVXDGXXDVFVFD 
VDDF DDDA 


132 183 IM 


187 168 13B 170 


178 178 176 


III. DFADGGVFDAVDGXFVDAAVGD 
XI. DFFFXGXGXAGAGVGDVVXGFV 
VII. AFDFXDXGDAADVDDVADDVDV 
' FVDF AVDG 


177 178 17» 180 181 182 183 184 186 186 

m. X F G G D D X G D A 

XI. DXDDXFVDDX 
VII. AFVFXFAAVD 
D F V D 


Fiqub* 72.—Continued. 


Cryptogram 1 

Length 

Letters taken 

Cryptogram 

I.«ngth 

Letters taken 

I 

212 

VDDGGGVFDFVD 

VII 

254 

GAFGFFXFVFGFXA 

II 

108 

VDAAVD 

VIII 

144 

DGWGFXG 

III 

186 

DAGAAFGAGV 

IX 

182 

GDDDDXVGVD 

IV 

110 

ADXVFTC 

X 

130 

DGDDFVF 

V 

202 

DFXFDDVWDX 

XI 

186 

VFDDVAXGDA 

VI 

120 

GDGFXAG 

XII 

224 

XFDFXWDVDAVD 


FiouRX 73. 


The new frequency weights are therefore as follows: 


Odd (iBt, 3d,. . .) letters 
A D F G V X 

5 g g g g 

^ g g 
g ^ g 

Total -4+14+6+11 + 15 + 10-59 


Even (2d, 4th,. . .) letters 
A D F G V X 

g g g g g = 

g g g 5 ^ 

g g 

Total - 9+16 + 14+8 + 7 + 2- 68 

Figvri 74. 


Since the two totals are quite close together, no correction need be made of the nature of that 
made in preceding calculations, where one-sixth was deducted from the total values of odd letters. 

n. Beginning with position 23, in the case of cryptograms III and XI, the next U letters, 
and, in the case of cryptogram VII, the next 15 letters are clearly of the type of alterna¬ 
tion. The data are as follows: 


23 24 23 26 27 28 29 30 31 32 33 

III. VXGFXFDXDDA 
XI. XDAFDDXGGAV 
VII. VDVFFADAVAV 
F V G G 








Distribution of odd letters 

A D F G V X 
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Distribution of even letters 
A D F G V X 


/- 841373 /- 446203 

Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as Oi’s, even letters as Gj’s): 

2(4)+4(14)+ 1(5)+3(11) + 7(15)+3(10)=237 
4(9)+4(15)+6(14)+ 2(8)+ 0(7)+ 2(2) = 186 
Total=423 

On the basis of figure 74 reversed (even letters as 0i’s, odd letters as 0’a’s): 

4(4)+4(14)+ 5(5)+2(ll)+0(15)+2(10) = 139 
2(9)+4(15)+ 1(14)+ 3(8)+ 7(7)+ 3(2) = 171 
Total=310 

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation for the 
third section of letters is 0i-» Qi-* 0i, or “ + ”. 

0 . Continuing the foregoing process with the letters beyond position 33, the data are as 
follows: 


34 38 36 37 88 39 40 41 42 43 44 

III. GADDGVADD'VD 
XI. GAGDVDFDFDD 
VII. ADAAFVFDVFD 
X F X X 


Distribution of odd letters 

A D F G V X 

5 g - 5 ^ 

/- a s' 1 0 3 2 

Weighted values of distributions: 


Distribution of even letters 

A D F G V X 

5 g g § ^ 

a 5 8 4 2 1 


On the basis of fi^re 74 normal (odd letters as 0i’a, even letters as 0a’s); 


3(4)+8(14)+ 1(5)+0(11)+3(1S)+2(10)=1&4 
3(9)+5(15)+5(14)+ 4(8)+ 2(7)+ 1(2)=^ 
Total=414 


On the basis of %ure 74 reversed (even letters as 0i’s, odd letters as 0a’s): 

3(4)+5(14) + 5(5) +4(11) +2(15) +1 (10)=191 
3(9)+8(15)+ 1(14)+ 0(8)+ 3(7)+ 2(2) = 11^ 

Total=377 




.. 
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Since the distribution begins here with an even-numbered position (34), and the greatest total is 
obtained on the basis of figure 74 normal, hence the alternation for the fourth section or column 
is of the type 0a-> 0i-> 0j, or"—”. 

p. (1) The data for the letters beyond position 44 are as follows: 

45 46 47 48 49 60 61 82 53 64 88 

III. DGAFGAVGDGX 
XI. DGAFAFDAAAG 
VII. GDXDDFVDFFX 
D V F X 


Distribution of odd letters 
A D F G V X 


Distribution of even letters 

A D F G V X 


/- 4 


Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0i’s, even letters as 02 ’s): 


4(4)+5(14)+ 1(5)+3(11)+3(15)+4(10)=209 
3(9)+4(15)+6(14)+ 4(8)+ 0(7)+ 0(2)=^ 
Total=412 


On the basis of figure 74 reversed (even letters as 0i's, odd letters as 02 ’s): 

3(4) +4(14) + 6(5) +4(11) +0(15)+0(10) = 142 
4(9)+5(15)+ 1(14)+ 3(8)+ 3(7)+ 4(2) = m 
Total=320 


Since the distribution starts with an odd position (45) and the greatest total is obtained on the 
basis of figure 74 normal, the type of alternation for the fifth section or column is 0i-> 03 -^ 0,, 
or“+”. 

q. The types of alternation for the first 5 columns, which are all long columns, is there¬ 
fore + + -1-!-. Since cryptograms III and XI contain but one short column, it is advisable 

to be on the lookout for it as the work progresses. It is possible to continue with the process 
detailed above. For example, the calculations for the next or sixth section of 11 letters are 
shown below: 

68 67 68 69 80 84 62 63 64 66 66 

III. DDDAVFVDDFD 
XI. VAVFGGVADDG 
VII. VADXVAXDVXA 
F F V D 


Distribution of odd letters 

A D F G V X 

g § § ^ ^ = 


Distribution of even letters 

A D F G V X 

g " = g 



/- B 
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Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as Bi’s, even letters as 02 ’s): 

5(4)+4(14)+ 4(5) + l(ll) + l(15)+2(10)=:142 
1(9)+7(15) + 1(14)+ 2(8)+ 8(7) + l(2) =2^ 

Total=344 

On the basis of figure 74 reversed (even letters as 6 i's, odd letters as 62 's): 

1(4)+7(14)+ 1(6)+2(11)+8(15) + 1(10)=269 
5(9)+4(15)+4(14)+ 1(8)+ 1(7)+ 2(2)=^ 

Total=439 

Since the distribution starts with an even position (56) and the greatest total is obtained on the 
basis of figure 74 reversed, the type of alternation for the sixth section or column is 0 i-» 02 -> 0 i, 
or “+”. 

r. But perhaps advantage should be taken of the availability of additional cryptograms. 
For example, cryptogramV,of 202 letters, has 2 short columns [(17X12)—2=202], whereas the 
cryptograms thus far dealt with each have but one. That is, ciyptogram V has one short column 
in common with cryptograms III, XI, and VII, and one additional short column not possessed 
by the latter. Can this additional short column of cryptogram V be located? 

s. Suppose column 1 of ciyptogram V is the additional short column. Then the letters of 
column 2 would beFXFXFFFVAGFD. These letters when evaluated on the 
basis of figure 74 normal yield a total of 77; when weighted on the basis of figure 74 reversed, 
a total of 144. The calcidation is as follows: 


Distribution of odd letters Distribution of even letters 

ADFGV X ADFGVX 



On the basis of figure 74 normal (odd letters as 0 i’s, even letters as 02 ’s): 

1(4)+0(14)+ 6(5)+0(11)+0(15)+0(10) =29 
0(9) + l(16) + l(14)+ 1(8)+ 1(7)+ 2(2)=48 
Total=77 


On the basis of figure 74 reversed (even letters as 0 i’s, odd letters as 02 ’s): 

1(9)+0(16)+5(14)+ 0(8)+ 0(7)+ 0(2)=79 
0(4)+l(14)+ 1(5) + 1(11) + 1(15)+2(10)^ 

Total=144 

According to this calculation, column 2 of cryptogram V seems to correspond to the type of 
alternation 02 -» 0 i-> 02 , that is “—But from previous work it is fairly certain that column 2 
is of the “+” type. Hence, column 1 of cryptogram V is probably not the additional short 
column of that message. Assuming column 2 to be the extra short column, no such contra¬ 
diction is obtained, for the calculation is as follows: 
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Assuming column 2 to be short, the letters of column 3areXAVDAGFDVDGF. 

Distribution of odd letters Distribution of even letters 

ADFGVX ADFGVX 

/> 101121 /- 131100 

Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0 i’s, even letters as 02 ’s): 

1(4)+0(14)+1(5) + 1(11)+2(15) + 1(10) = 60 

1(9)+ 3(15) + 1(14)+ 1(8)+90(7)+0(2) =_^ 

Total=136 

On the basis of figures 74 reversed (even letters as 0 i’s, odd letters as 02 ’ 2 ): 

1(9)+0(15) + 1(14)+ 1(8)+ 2(7) + l (2)= 47 
1(4)+3(14)+ 1(5)+1(11)+0(15)+0(10)=_62 
Total=109 

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation is 

01 ^ 02-^01 and column 3 is a '*+” column, which is consistent with the formula + + -]-[- for 

columns 1 to 5, as previously ascertained. 

If all the foregoing reasoning is correct, and column 2 is the additional short column for crypto¬ 
gram V, it must be the next to the last column of the transposition rectangle. Since it is a 
“+” column, the last column must be a ” one; therefore, there are 9 ” columns and 

8 “+” columns. 'This definitely determines that the ” columns are the odd ones, the “ + ” 
columns the even ones, since in an odd-width rectangle there is one more odd column than even 
columns. 

t. The single short column which is common to cryptograms III, XI, and VII is one of the 
columns beyond column 5. Assuming each possibility in turn, there is obtained for the type of 
alternation in each column the distributions of “+” and “ —” shown in figure 75. 


Assumption 

Column 

Sununationof 
+’s and -’s 

1 

2 

3 

4 

5 

6 

7 

8 

0 

10 

11 

12 

13 

14 

15 

16 

17 




+ 




+ 




+ 








(2) 7th short_ 

+ 

+ 

+ 

- 

+ 

+ 


+ 

- 

+ 

+ 

+ 

- 

- 

- 

- 

- 

9+i 8- 





_ 







+ 





_ 



(5) 10th short..-.- 

+ 

+ 

+ 

_ 

+ 

+ 

- 

- 

+ 


+ 

+ 

_ 

_ 

_ 

- 

- 

8-i-i 9- 

(6) 11th short__ 

(7) ISMih ehnW: 

+ 

+ 

+ 

- 

+ 

+ 

- 

- 

+ 

- 

- 

+ 

- 

- 

- 

- 

- 

7+, 10- 

(ft) Iftfh a>ini4. 


+ 





~\ 



“1 








7+' 10~ 

(9) 14th short_ 

+ 

+ 

+ 

_ 

+ 

+ 

_ 

_ 

+ 

_| 

_ 

_ 

+ 1 

+ 

I| 

_ 

_ 

8+1 9- 

(10) 16th short-. 

+ 

+ 

+ 

— 

+ 

+ 

— 

— 

+ 

— 

— 

— 

+ ' 

+ 

+' 

— 

— 

9+, 8- 

(11) 16th short.1 

-f. 

-j- 

-f 


-1- 

-f 



-f 




-{-1 


4.1 

4. 


IO4-, 7— 

(12) 17th short_ 

+ 

+ 

+ 

1 - 

+ 

+ 

- 

- 

+ 


- 


1 

+ 

+ 

J 

+ 

+ 

11+, 6- 


Fiocri 75. 


u. The correct assumption must satisfy the following conditions: 

(а) There must be 9 ” and 8 “ + ” columns. 

( б ) The short column must be “ — 

324165—41-10 
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Only assumptions (3) and (5), in which column 8 and column 10 are short colunms, satisfy these 
conditions. Therefore, colunrn 2 is followed by either column 8 or 10. Testing the combination 
2-8 for monoalphabeticity of bipartite pairs, the distribution shown in figure 76 is obtained. 
When combination 2-10 is tested, the distribution shown in figure 77 is obtained. Obviously, 
the 2-8 combination is the better. 

3d component 2d component 




E (0) = .O667X17X16=18.14 
<f> = 22 


E (0) = .O667X17X16=18.14 
0=4 






V. It is possible by introducing cryptograms with additional short columns to determine 
more of the key. Thus, it was found by using cryptograms XII and VI that the first 3 numbers 
of the transposition key are 16-5-7. But the process of anagramming will yield the solution at 
least as rapidly. In this process, of course, advantage may be taken of the fact that the colunms 
have been classified into the “ + ” and “ —” types and no combinations of two or two 

“ — ” columns need be tested, since only combinations of the type" H-” or“-h ” are permissible. 

w. The final transposition key and the substitution checkerboard are shown in figure 78. 

16 6 7 6 9 3 14 1 13 11 17 10 4 12 . 1.1 3 R 

V I K " rN-G "' s C R 0 W ~ N"H — r ~ T "E '“ L 


A 
- D 
F 

S G 
V 
X 


2d component 

A D F G V X 


V 

I 

9 

K 

N 

G 

7 

S 

C 

3 

R 

0 

W 

H 

8 

T 

E 

5 

L 

A 

1 

B 

2 

D 

4 

F 

”6~ 

J 

IT 

H 

P 

~Q~ 

IT 

X 

Y 

Z 


Fiqurs 78. 


*. All the foregoing details concern a case in which the transposition rectangle has an odd 
number of colunms. Now if the rectangle contains an even number of columns, this type of 
solution is, of course, still applicable, and in fact is easier, since the letters of the text of the re- 
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spective sections do not have to be distributed into odd and even letters. It is only necessary 
to identify a section as being composed of initial components or of final components. T his 
analysis then produces a series of sections corresponding in number with the number of columns 
in the transposition rectangle. This number will, of course, be even. By a careful study of 
where alternations in composition of components (Oj or 62 ) occm, the division of the text into 
sections corresponding to long and short columns can be accomplished. The remaining steps 
are obvious and follow the lines elucidated in paragraph B9e-j. 

y. The entire structure upon which this general solution rests is destroyed if the substitution 
checkerboard has been consciously manipulated to equalize or flatten out the sums of the weighted 
frequencies of the letters in its rows and columns. For example, note the following checkerboard, 
which is not "perfect” but gives approximately similar frequencies in its rows and colunms.* 


2d component 



A 

D 

F 

G 

V 

X 

Sums 


I 

Q 

S 


u 




74 

3 

61 


26 


164 



T 


W 

c 

p 




92 


16 

31 

27 

166 


G 


A 



N 


r 

16 


74 



79 

169 

Ig 

X 

V 

J 

E 

B 

K 


s ^ 

5 

18 

2 

130 

10 

3 

165 


R 

1 M 

F 


L 




76 

25 

28 


36 


165 



D 

z 

y 

i 0 

H 




** 

1 

19 

1 75 

34 

169 

Sams 

171 


166 

1 165 

1 158 

163 j 

1,000 


ViavKK 79. 


z. If the statistical calculations upon which this general solution is based make use of the 
logarithms of the frequencies instead of the frequencies themselves, much more accurate and 
clear-cut data will be obtained. 

‘ The frequencies indicated as those given in fig. 3, p. 13, MUitaty Cryptarudygu, Fart I. 











Section X 

SOLUTION OF BIFID FRACTIONATING SYSTEMS 


Paragraph 


Review of principles underlying the cryptographic method. 44 

Example of a simple bifid cipher...... 45 

Principles of solution...- 46 

Example of solution.........—... 47 

Special solution............ 48 

Periodic bifid ciphere......—____ 49 

General principles underlying the solution.......-.-.—1- 50 

Ascertaining the length of the period...—...-.. 51 

Illustration of solution...........—.— 52 

Special solutions for bifid systems...........— 53 

Solution of trifid systems.......-... 54 

Concluding remarks on fractionating systems...-.-...—... 55 

Concluding remarks on transposition systems..... 56 


44. Review of principles underlying the cryptographic method.—Several bifid fractionating 
systems have been explained in previous texts of this series.* In certain of these systems four 
basic steps are involved, two of substitution and two of transposition. These steps may be 
briefly described as follows: (1) A process of decomposition (substitution), in which each plain¬ 
text letter is replaced by two components, and 0^ of a bifid or bipartite alphabet; (2) a 
process of separation (transposition), in which the 0'0o components originally paired together 
are separated; (3) a process of recombination (transposition), in which the separated compo¬ 
nents are combined to form new pairs; (4) a process of recomposition (substitution), in which 
each new pair of components is given a letter value according to the original or a different bifid 
alphabet. 

45. Example of a simple bifid cipher.— a. One of the simplest bifid fractionating systems 
is that exemplified in the following subparagraphs. It will be employed to set forth certain 
principles in the general solution of systems of this and similar nature. 

b. Given the 25-cell substitution checkerboard shown in figure 80, let the message to be 
enciphered be ONE PLANE REPORTED LOST AT SEA. The first step is to replace the plain¬ 
text letters by the bipartite equivalents, the two elements or components being set down ver¬ 
tically beneath the plain-text letters. This represents the first two of the four processes re¬ 
ferred to in paragraph 44, the first beii^ that of decomposition or substitution, the second, that 
of separation or transposition, repr^ented by the manner in which the two bipartite elements 
are set down vertically (instead of horizontally), thus separating the two elements from their 
normal horizontal juxtaposition. 

* See Special Text No. 186, Advanced Military Cryptography, sec. XI and Military Cryptanalysis, Part I, 
sec, IX. 
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Plain text_0 N E 

Components. .)* * * 

U 8 3 


3d camponeot 

1 2 3 4 5 


M 

A 

N 

u 

F 

C 

T 

R 

I 

G 

B 

z 

E 

H 

K 

L- 

0 

P 

Q 

S 

V 

'w' 

X 

y 

Z 


fiockk m. 


PLANE REPORTED LOST AT 

44113 23442233 4442 12 

3123 3 33323232 1253 32 


SEA 

5 3 2 


The third process, that of recombination or recomposition, also involving a transposition, is now 
to be performed and will consist in combining elements standby in diagonal relationship to the 
right, that is, as shown by the arrows below: 


ONE PLANE REPORTED LOST AT SEA 

418 44113 23442233 4442 12 431 

/ / / / / 

233 31233 33323232 1252 23 632 


giving the pairs 21, 33, 34, 34, 11, 21, 33, etc. There are left, at the end of the process, one 
element in the upper line at the extreme left and another element in the lower line at the extreme 
right, yielding the pair 24, which may be placed at the head or tail of the resultant combinations, 
as preagreed. The last or fourth process, that of recomposition or substitution, is to replace the 
new pairs of components by letters from the original or a new checkerboard. If the same 
dieckerboard is used, it yields the text shown herewith: 


Plain..0 N E PLANE 

Components..]*;, * 

(2 3 3 3 1 2 3 3 

Cipher_C EH H M C E D 

e. Another and perhaps more simple way of accomplishing the same process is to s 
the bipartite equivalents horizontally and recombine them as shown below: 


REPORTED LOST AT SEA 

33442333 4442 12 43 1(4) 

33323232 1232 22 332 

EHHTDREI UIWC TI XBI 


ONEPLANE 

43 13 33 43 41 12 18 33 . . 

■V 'V V/* ■S.^ 

C E H H M C E 


The results are identical with those obtained from the preceding manner of operation. The 
text is of course sent in 5-letter groups. 

d. Instead of using the digits 1, 2, 3, 4, 5, as the bipartite components one can use the 
vowels A, E, 1, 0, U, or any other characters that are deemed suitable. Perhaps d^ts are best 
as they are less likdy to be confused with letters of the text. 

e. As intimated above, the checkerboard used for the recomposition may be different from 
that employed in the decomposition. But it will be shown that the additional safety afforded 
by using two different checkerboards is somewhat illusory, and is by no means as great as may 
appear on first consideration. 
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46. Principles of solution.— a. Note the following skeleton encipherments, using the 
checkerboard shown in figure 80; 


C E N 0 

SEND 

R ^ C 

H E N A 

T E_N Y 


*/*/'*/* 

2 3 12 

3 3 11 

2 I 3 ! 

N B H 

X B E 

E B D 

P B B 

R B K 

(1) 

(2) 

(3) 

74 ) 

(5) 


These five encipherments have in common a plain-text digraph EN. The five cipher versions, 
however, have only a single letter in common, B. This is, of coiu’se, a phenomenon already 
encountered many times by the student and its cause is easily understood by him: The mechanics 
of the system tend to reduce by one character the lengths of the repetitions in the cipher text, 
as compared with their lengths in the plain text, a trigraphic repetition in the plain text mani¬ 
festing itself as a digraphic repetition in the cipher text, a tctragraphic one becoming a trigraphic, 
and so on. More will later be stated on this phase of the matter. 

6. But now study the individual cipher letter immediately preceding and succeeding the 
cipher letter which these five encipherments have in common. They are as follows; 

Letters preceding Bo.N, X, E, P, R 

Letters succeeding Be.H, E, D, B, K 

Reference to the checkerboard discloses the very interesting and important fact that the letters 
preceding the cipher repetition (Be) (M come from the same column in the checkerboard, the letters 
succeeding the repetition all come from the same row in the checkerboard. How this phenomenon 
is brought about is quite simple to see. Take the first of the five examples, that in which 
C E N Op produces N B H*. The Ne is the result of combining the second component of the 
bipartite equivalent of Cp with the first component bipartite equivalent of Ep, yielding the com¬ 
bination 13, which is N. No matter what the other thi-ee letters in the plain-text tetragraph 
may be, if the second letter is Ep, the second component bified equivalent of the first letter of 
the cipher trigraph must be a 3. This means that this first letter of the cipher trigraph must 
come from column 3 of the checkerboard. Exactly which row this letter will come from is deter¬ 
mined by the identity of the second component of the bifid equivalent of the first letter of the 
plain-text tetragraph. Hence, since the 5 tetragraphs in the example all have the same plain¬ 
text letter in the second position, the initial letters of the cipher trigraphs all must come from 
the same column of the checkerboard. It is unnecessary to go through the reasoning, which is 
parallel, in the case of the third letters of the cipher trigraphs: these all must come from the 
same row of the checkerboard. 

c. A good understanding of the phenomenon just noted can certainly be employed to 
advantage in solving this and similar tsrpes of systems, for it becomes obvious that a careful study 
of the letters immediately preceding and following cipher repetitions should faciliMe a reconstruction 
of the checkerboard employed in the substitution.* Indeed, if there were no other phenomena to 
disturb this very simple relationship, solution would be quite easy. All that would be required 
would be to study the prefixes and suflaxes to all the A’s, B’s, C’s, ... in the cryptogram, find 
the letters which belong in the same colunms and rows of the checkerboard, and the reconstruc¬ 
tion of the latter would follow very simply. Unfortimately, however, there is a disturbing 
phenomenon which must now be considered. 

* The principle involved in such reconstruction was, to my knowledge, first pointed out and successfully 
employed early in 1938 by Associate Cryptanalysts S. Kullback and A. Sinkov. 
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d. Note the following encipherments: 

Plain. LPUR ORMI 

41 43 14 23 42 23 11 24 

Cipher. U B 0 T B A 

(6) (7) 

Here the Bo is preceded by letters (U and T) which not only arc not in the same column as those 
in the corresponding position in the case of the first five encipherments, but also these two letters 
are themselves in different columns. The cause of this is not difficult to see. It is merely that 
the second component of the Pp and the second component of the Rp happen to be identical, the 
first component of the Up and the first component of the Mp also happen to be identical, thus 
producing the same cipher letter in both cases. This is a phenomenon which must happen by 
chance a certain number of times, a number which is dependent not only upon the mechanics 
of the system but also upon the exact composition of the checkerboard. Disregarding for the 
moment the latter factor, it is obvious that if the checkerboard is perfectly balanced, the bifid 
element 3, for example, should occur 20 percent of the time as the first or as the second element 
of a bifid pair, since there are 5 elements and each can theoretically appear an equal number of 
times. However, since the checkerboard is not perfectly balanced, the bifid element 5 can, in 
the case of figure 80, appear as a second component of the bipartite equivalent of a cipher lettci 
only very rarely, since it corresponds to the first component of the bifid equivalents of the letters 
V, W, X, Y, and Z, all of which are of low frequency. On the other hand, the bifid element 3, in 
the case of figure 80, can appear very frequently as a first component of the bifid equivalent of 
a cipher letter because it is the second component of the bifid equivalents for the high-frequency 
plain-text letters N, R, and E, which are all in column 3. However, since the exact composition 
of the checkerboard is unknown when cryptograms of this sort are to be solved, frequency 
w aigh ta can, of course, not be assigned to any of the components or bipartite elements and it 
win have to be assumed that each one has an equal probability of occurrence, that is, one-fifth. 

e. From the foregoing discussion it is obvious that it would be unwise merely to study the 
prefixes and suffixes to identical single letters of the cipher text in an attempt to solve crypto¬ 
grams of this sort, for the disturbing effect of the accidental identities of certain cipher letters 
would be sufficient to retard solution. A few detailed examples of the type of study that must 
be made in connection with repetitions in such systems as this will now be given. 

f. It was stated in subparagraph a that the mechanics of the system tend to reduce by one 
character the lengths of the repetitions in the cipher text. The expression “tend to reduce” 
aptly describes the situation, for not only can it happen that a 3-letter repetition in the plain 
text may appear to remain a 3-letter repetition in the cipher text, but also it can happen that 
a 3-letter repetition in the plain text may even appear as a pseudo 4-lettcr repetition in the 


cipher text. 

Study the following examples (based 

on fig. 80) and note what happens in 

each case; 

i.A) 

F T H E C 

(A) 

N T H E D 

A 

IS 22 34 33 21 

13 22 34 33 32 

12 


W R_P D 


D R P E C 


{B) 

Y T H E Y 

64 22 34 33 64 

(^ 

T T H E H 

22 22 84 33 84 

A 

12 


0 R_P K 


T R P._. E_ L 



(1) 


(2) 



A 3-lett»r pWn text repetition eppoere ee e 2-lettor cipher text repe- A 3-Ietter plain-text repetition appears as a 3-letter cipher-text repe- 
titlon becaase the Ist components of the Dp and Hp happen to be identical 
p and H are in same row in checkerboard). 
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iA) 

1 

N 

T 

H 


E 

G 

iA) 

T 
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T 

H 

E 

M 

A 

24 

13 

22 

34 


33 

25 

22 

42 

22 

34 

33 

11 

12 


L 

D 

R 


P 

D 



I 

T 

R 

p 

B 

M 


(B) 

0 

R 

T 

H 


E 

U 

(.B) 

N 

D 

T 

H 

E 

N 

E 

42 

23 

22 

34 


33 

14 

13 

32 

22 

34 

33 

13 

33 


T 

D. 

_R 


P 

B 



E 

T_ 

R 

P 

B 

E 



(3) (4) 

A 3-Ietter plain-text repetition appeaie as a 3-letter dpher-text repetl- A 3-letter plain-text repetition appears as a 4-letter cipher-text repe- 
tlon because the second component of the Ng and Rp happen to be Iden- tltion because the phenomena of case 2 and case 3 occur simultaneously 
tical (RandN are in same column in cheokerboardl. (Oand Dare in same colnmn'.Hand Rare in the same row in the checker¬ 

board). 

g. From a study of these phenomena the rule may be deduced that an n-letter repetition 
in the plain text is really reduced to an (n-l)-letter repetition in the cipher text, hut it can happen 
fortuitously * that the real repetition is extended on either or both ends of the repetition by a 
pseudo-repetitious letter. Hence, a 3-letter plain-text repetition may appear as a 2-, 3-, or 
4-letter repetition in the cipher-text. 

h. It is therefore possible to make wholly erroneous deductions from some repetitions, es¬ 
pecially if the latter are short. Note for instance the following example, still using Fig. 80 
as a basis: 

F 0 U R D A (YS) S 0 M E D U (TY) 

15 42 14 23 32 12 . . . 45 42 11 33 32 14 . . . 

YCODC YCNDC 

Here are 2 sequences of 5 cipher letters, identical save in the central letter, and yet the 6-letter 
plain text sequences have only 2 letters in common. This example is cited to show that the 
cryptanalyst must be very careful in respect to the deductions he may make in the case of short 
repetitions. In the example cited it happens that the accidental repetitions are such as to make 
the sequences as a whole almost appear to be identical. 

i. It is these pseudo-repetitious elements which complicate the solution of what would 
otherwise be a simple system. To illustrate what is meant, note that in case (1) of subparagraph 
y the letters W, and Oo, the prefixes to the repetition RPo, do actually come from the same column 
of the checkerboard; the letters D, and Ke, the suffixes, do actually come from the same row. 
But now note in case (2) that while the prefixes D# and Te come from the same column, the suf¬ 
fixes C, and Lo do not come from the same row. Note also in case (3) that while the prefixes 
L, and To do not come from the same column, the suffixes. Do and Bo, do come from the same row; 
while in case (4) the prefixes turn out to be the same letter. To (which constitutes an example 
where the two prefixes come from the same column) but the suffixes. Mo and Eo, come from differ¬ 
ent rows. Since the exact length of the real repetition, without its pseudo-repetitious elements, 
does not readily manifest itself in the cipher text (although in favorable cases it may be deduced 
by a careful detailed analysis and comparison with nearly similar repetitions) the nature of the 
difficulties confronting the cryptanalyst become apparent. 

j. The nature of the detailed analysis and comparison of repetitions referred to above may 
require a few words of explanation. Suppose that a cr3T)togram shows many occurrences of 
RPe (=THEp in the foregoing examples). It would indicate a high-frequency plain-text trigraph. 
A few repetitions of such cipher tr^aphs as RPEc, DRP«, TRPBo, would lead to the surmise that 
the latter are of the type where pseudo-repetitious elements have crept into the picture and there- 

* Strictly speaking, of course, not really fortuitously. It depends upon the exact letters which precede or 
follow the plain-text repetition and the exact positions these letters occupy in the checkerboard. 
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fore the cryptanalyst should he very hesitant to assume that the adventitious prefixed letters 
are in the same columns, or that the adventitious suffixed letters are in the same row. In fact, 
he would be warranted in tentatively assuming the very opposite condition, that they are not 
in the same columns or rows, respectively. The conclusions derivable from a study of short 
repetitions can be carried over to the longer ones. Note the following four cases from which 
several conclusions may be reached: 


( 1 ) 


URPOSITIONSA 

14 23 43 42 JS 24 22 24 42 13 45 12 

0 H H I W 0 T Q C H V 


( 2 ) 


ISPOSITIONOF 

24 42 43 42 45 24 22 24 42 13 42 15 

Q Y H I W 0 T Q C H C 


( 3 ) 


H E ^ 

34 33 43 

P H I 


I D E 

r 32 33 

E R 


(4) 



I T I 0 N 

24 22 24 42 13 

0 T Q C H 


L 

41 


u 


M 


14 


First, the 7-letter cipher sequence HIWOTQCis common to all four cases; if only the cipher 
text were available, one could conclude that the plain-text repetition consists of 8 letters. Second, 
the letters H and Y probably come from the same column in the checkerboard, but as for 0, P, 
and T, they may or may not come from the same column, most probably not. (Actually, 0 and 
T do, but P does not come from the same column as these 2 letters.) Third, the letters H and E 
probably come from the same row in the checkerboard, but as for V, C, and M, they may or may 
not come from the same row, most probably not. (Actually, all 3 letters come from different 
rows.) 

k. Note the following cases of encipherment: The fact that the 7-letter cipher sequence is 
common to all four cases means that the plain-text repetition consists of 8 letters. 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 16 16 


_N S I 1 

13 45 24 1 

I H W L 


T H 1 

22 34 3: 

W R P 


( 2 ) 


_N F I F T 

13 15 24 15 22 

B W L W R 


0 N T P_ 

42 13 22 43 

C D I I 


H R 

34 23 

0 


N L I F T I N 

13 41 24 15 22 24 13 

! H A L W T L 


w 

(3) M 


A S P_ 

12 45 43 

C I Y I 


talpositiontifli s 

(41 22 12 41 43 42 46 24 22 24 42 13 22 24 15 41 24 4.5 

CIUHIWOTQCDTLYAQ 


3 4 


6 7 


9 10 11 12 13 14 IS 16 
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The pseudo-repetitious letters, I in the third position in cases (1) and (2), and the letters 
Y, and Ue in corresponding positions in cases (3) and (4) mean that I, U, and Y, come from the 
same column of the checkerboard. The I« in position 2, in cases (1), (3), and (4) and the D# 
in the corresponding position in case (2) indicates that !« and De are probably in different columns 
in the checkerboard. In position 11, the H,, Be, and Dc give indications of being in the same 
row of the checkerboard. In position 14, W, and Y, likewise give indications of coming from the 
same row. But note now that from position 12 it may be deduced that W, A, and T come from 
the same column of the checkerboard. These are examples of the type of detailed analysis 
that the student should follow in his attempt to solve a problem of this sort. 

l. In general it may be said that when the repetitions are numerous and fairly lengthy, that 
is when there is a good deal of traffic all in the same checkerboard, and repetitions of tetragraphs 
and better are plentiful, solution should be relatively easy. In fact, with a fairly large amoimt 
of traffic, most of the work involved would consist in listing the 2, 3, 4 . . . letter repetitions. 
Then a chart would be drawn up to show the associations which the prefixes make among them¬ 
selves and the associations which the suffixes make among themselves. For example: 

X A B Q 
N A B R 
Z A B T 
N A B Q 
LABI 
Z A B T 

Here it is noted that L, N, X, and Z appear as prefixes to repetitions. The letter X is “found in 
company” with N twice; the “association value” of X and N is 2 units. The association value of 
Z and N is, however, 4 units, for the N occurs twice and so does the Z. The association value of 
LX or LZ is 1 unit; that of LN or LZ, 2 units. Thus, the association value for each combination 
can be studied in all the repetitions and, of course, when the value is high for a given combina¬ 
tion it indicates that the two letters really belong together, or in the same column of the checker¬ 
board. 

m. What can be done with but one or two relatively short cryptograms depends largely 
upon their lengths, the number of repetitions they happen to have, the exact construction of 
the checkerboard, and the ingenuity and patience of the cryptanalyst. CVnce the letters that 
constitute the columns and the rows of the checkerboard employed in the recomposition are 
known, the proper assembling of the colunms and rows is a relatively simple matter. If a key¬ 
word has been used as the basis for the distribution or mixing of the letters, naturally the recon¬ 
struction of the checkerboard is much facilitated. If not, then either the original or an equiv¬ 
alent checkerboard may be reconstructed. Having the recomposition checkerboard at hand, 
the determination as to whether it is the same as that used in the decomposition follows directly. 
If not the same, the reconstruction of the decomposition checkerboard is a relatively simple 
matter. 
















8Mlli5-tt (Fae>P.lSl) 








47. Example of solution.—a. Suppose the two following cryptograms suspected of being in 
the same key are at hand; 

No. 1 


I S D C Y 
X L Y I W 
U B I N R 
W D C V S 
T I W A U 
N I I U H 
T L G W W 
D T W A U 
N I N B D 
Y I R N G 
I N I N D 
C L P W V 
N G T I W 


I W V E W 
D A I N B 
K V L Q D 
0 D C G S 
U I A A Q 
Q D T X W 
A L W D S 
U I A A Q 
R Q T Q V 
T I W A U 
C U W W D 
R V S D D 
A U U I A 


D N B A X 
D R W V R 
N L Q D T 
I S S G U 
C W N B I 
I T A V N 
N S I L N 
D G T E L 
E W C W S 
U I A A Q 
S N I L V 
T N U L Q 
A Q C Q D 


W S A V I 

V S D D T 

V T I N I 
H K I R X 
E W A Y U 
N I N D C 
N I R N G 
Q D T X D 
C L P I T 
C Q D T Z 
N 0 D L Q 
D U H K I 
T V 


W I L T K 
N U L Q D 
N D C U W 
Y I R N G 
L Q S A V 
U ff W C G 
S T L B D 
W Y I W X 
L K I R X 
I I W V T 
D T X W S 
R X Y I R 


I W I L T 
D I W I R 
R V S D D 
T Q G T E 
L Q D U H 
I I L W N 
V T T A Q 
B D R W S 
D T N I L 
D T W 


G S I H W 
C V N 0 D 
T I L L Q 
U D V Q C 
K I R X Y 
K I R N G 
A V N I I 
C L P L W 
V N 0 D N 


W A W K I 
N G S L N 
D U K D W 
0 I W T X 
I R N B A 
S T L B D 
U H Q D T 
A H N T L 
U L Q D U 


N D C U W 
G I G W L 
S S H X S 
W V R V S 
Y I I I G 
D T I T I 
X D W Y I 
Q D T X C 
B G T E W 


W A X L X 

V F D W V 

E N C Q D 

D D T N U 

T E W A Y 

L U D V L 

W X N I N 

W S C I V 

V R V S D 


h. A careful and detailed listing of significant repetitions is made, these to show the single¬ 
letter prefix and suffix in each case. A partial list of the many repetitions present in the two 
cryptograms is given in figure 81. 

c. Consider the first set of repetitions listed in figure 81, as extracted and shown in figure 82. 
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According to the principles eluddated in the preceding paragraph, it would seem that the 
following tentative deductions may be made from the data contained in the columns of figure 82: 

(1) From column 1: E, D, R, P, X belong in the same column of the checkerboard. 

(2) From column 10: W, I, N beloi^ in the same row. 

(3) From column 14: D and G belong in the same column. 

(4) From column 16: B and H belong in the same row. 

(5) From column 16: H and L belong in the same column. 

(6) From column 21: Y, K, N belong in the same column. 

(7) From column 25: G and B belong in the same row. 

(8) From column 27: I and T belong in the same column. 

(9) From column 33: I and W belong in the same row. 

(10) From column 36: C and D belong in the same row. 

(11) From column 37: W and Q belong in the same row. 

(12) From column 40: Q and V belong in the same row. 

It would be most fortimate and unusual for all these tentative deductions to be correct, for the 
disturbing effects of accidental adventitious repetitions have not been taken into account as 
yet. But let an attempt be made to assemble the data deduced thus far, to see if they can all 
be reconciled. 

d. Tentative deduction (1) indicates that E, D, R, P, and X belong m the same column of 
the recomposition checkerboard. If correct, the complete set of 5 letters of one column is at 
hand. But tentative deduction (3) indicates that D and G belong in the same column and this 
would mean that the column has 6 letters, which is impossible. Further evidence will be re¬ 
quired to corroborate the hypothesis that E, D, R, P, and X are all actually in the same column, 
or that D and G are actually in the same column. For this purpose, further study must be made, 
and it is convenient to compile an “association table” showing how often certain letters are 
associated among themselves as prefixes to the repetitions. A similar association table is made 
for the sufilxes. The tables may be combined in a manner similar to that shown in figure 83, 
where the prefixes to repetitions appear at the left of the central alphabet, the suffixes to the 
right. 

Take column 1 of figure 82, having D, E, P, R, and X as prefixes to a long repetition. A stroke 
is placed in the E, P, R, and X cells of row D; a stroke is placed in the P, R, and X cells of row E; 
a stroke is placed in the R and X cdls of row P; and finally a stroke is placed in the X cell of row R. 
Again, take column 16 of figure 82, reading B H H H L. The B need not be considered, since it is 
not a prefix to the repetition beginning K I R X Y . , but the H and L may be considered. 
In the L ceil of row H three strokes are inserted to indicate that H and L are associated that 
many times. Each time a datum is obtained, it is added to this table. Figure 83 shows the 
appearance of the table after all the data obtainable from the repetitions listed in subparagraph h 
have been inserted. From even this small amount of materiad a few deductions can be made. 
For example, it is seen that the B line of the table for prefixes shows 5 strokes at G and 3 strokes 
at ff, from which it would appear that B, G, and ff may be in the same column. The letters 
C and L likewise seem to be in the same column, as do H and L, making C, H, and L appear to 
be in the same column. Studying the table of suffixes, it would appear that B and H are in the 
same row; I and N are in a row. After the entire text has been examined and the prefixes and 
sufiSxes distributed in this way, the whole table is studied carefully with a view to eliminating 
the effects of the accidental or pseudo-repetitious letters, tiying to locate those letters which 
represent the prefixes and sufi^es of true repetitions. 









SUFFIXES 


PREFIXPJS 

(Letters in same column) (Letters in same row) 

ABCDEFGHIKLMNOPQRSTUVWXYZ ABCDEFGHIKLMNOPQRSTUVWXYZ 



ABCDEFGHIKLMNOPQRSTUVWXYZ ABCDEFGHIKLMNOPQRSTUVWXYZ 
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e. Suppose the data have been reduced to the following: 


Letters belonging in i 


Letters belonging in same rows 


( 1 ) 

(2) 

(3) 

(4) 


D. G, U 
H, L, C 
Y. K, N 
W. Q. S. 


T. B 


(1) G. B, H. K 

(2) I. W. N, L 

(3) D. C. A, S 

(4) Q. V. X. y. Z 

(5) T, U 


The presumption that Q, V, X, Y, and Z are aU in the same row leads to the assumption that 
the mixing of the checkerboard is based upon a key word or key phrase. Following up this 
hypothesis, the data are assembled in the following manner: 


1 2 3 4 5 


w 

I 

L 

N 


T 

U 




S 

D 

C 

A 


B 

G 

H 

K 


Q 

V 

X 

Y 

Z 


y. Only 6 letters remain to be placed in the checkerboard. But there are enough letters 
already placed to warrant an immediate attempt at decipherment. For example, take the 
first few groups of message No. 2 and replace the letters by their bipartite equivalents: 


IWILTGSIH 

12 11 12 13 21 42 31 12 43 


W W A 

11 11 34 


ff K 

11 44 


I 

12 


N 

14 


D 

32 


Recombining the bihd elements: 


. 1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2. 

Substituting by means of figure 84: 

.1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2. 

TWTDN?W?SWLBNBTH. 

Obviously the decomposition and recomposition checkerboards are different. But the recon¬ 
struction of the former is not at all difl^cult, since the text is now in monoalphabetic form. The 
message begins with a group showing a repeated letter in the first and third positions: is the 
1st word ENEMY? Probably it is, for message No. 1 also contains the sequence WILT. 
At any rate, a transcription of the cryptograms into the bifid equivalents given by the nearly 
complete recomposition checkerboard (fig. 84) soon yields sufficient monoalphabetic text to 
permit of the complete reconstruction of both checkerboards: 
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2d oomponent 

1 2 3 4 5 


2d componeiit 



1 

2 

3 

4 

5 


1 

2 

3 

4 

5 

1 

N 

U 

T 

Y 

P 

1 

W 

I 

L 

N 

0 

r 

E 

0 

I 

F 

L 

1 " 

T 

U 

R 

E 

M 

i' 

A 

M 

B 

C 

S 

1 ^ 

S 

D 

C 

A 

F 

s 4 

R 

W 

G 

D 

H 

S 4 

B 

G 

H 

K 

P 

5 

K 

Q 

V 

X 

Z 

5 

Q 

V 

X 

Y 

Z 


A 


B 


(Decomposition) 

I'ii 


Finvsi 85. 


(Recomposition) 


g. Speculating upon the key words used to produce the mixed sequences in these checker¬ 
boards, the trade-name N U T Y P E (a typewriter cleaning fluid) suggests looking at the 
label on the box containing a bottle of this chemical. It reads: NUTYPE NON- 
INFLAMMABLE TYPE CLEANSER, prepared by WALTER 
G. G I E S. This yields the sequence for the decomposition checkerboard. The legend 
on the box also reads: WILL NOT INJURE MOST DELICATE 
FABRICS AND FURNITURE, which yields the sequence for the 
recomposition checkerboard. 


A 
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A. The two cryptograms may now be deciphered directly from the checkerboards. The 
plain-texts are as follows: 

No. 1 

ISDCYIWVEWDNBAXWSAVIWILTK 

12 31 32 33 54 12 11 52 24 11 32 14 41 34 S3 11 31 34 52 12 11 12 13 21 44 

ITISREPORTEDTHATTHEENEMYH 

XLYIWDAINBDRWVRVSDDTNULQD 

53 13 54 12 11 32 34 12 14 41 32 23 11 52 23 52 31 32 32 21 14 22 13 51 32 

ASRETIREDTOAPOSITIONWESTO 

UBINRKVLQDNLQDTVTININDCUW 

22 41 12 14 23 44 62 13 51 32 14 13 51 32 21 52 21 12 14 12 14 32 38 22 11 

FNEWCHESTERSTOPONEREGIMEN 

WDCVSODCGSISSGUHKIRXYIRNG 

11 32 33 52 31 15 32 33 42 31 12 31 31 42 22 43 44 12 23 53 64 12 23 14 42 

TISINVICINITYOFCROSSROADO 

TIWAUUIAAQCWNBIEWAYULQSAV 

21 12 11 34 22 22 12 34 34 51 33 11 14 41 12 24 11 34 54 22 13 51 31 34 52 

NETWOEIGHTANDNORTHWESTTHE 

NIIUHQDTXWITAVNNINDCUWWCG 

14 12 12 22 43 51 32 21 53 11 12 21 34 62 14 14 12 14 32 33 22 11 11 33 42 

REOFSTOPANOTHERREGIMENTCO 

TLGWWALWDSNSILNNIRNGSTLBD 

21 13 42 11 11 34 13 11 32 31 14 31 12 13 14 14 12 23 14 42 31 21 13 41 32 

NCENTRATINGNEARROADJUNCTI 

DTWAUUIAAQDGTELQDTXDWYIWX 

32 21 11 34 22 22 12 34 34 51 32 42 21 24 13 51 32 21 63 32 11 54 12 11 53 

ONTWOEIGHTFOURSTOPBEPREPA 

NINBDRQTQVEWCWSCLPITLKIRX 

14 12 14 41 32 23 51 21 51 52 24 11 33 11 31 33 13 46 12 21 13 44 12 23 S3 

REDTOSUPPORTATTACKONCROSS 

YIRNGTIWAUUIAAQCQDTZIIWVT 

54 12 23 14 42 21 12 11 34 22 22 12 34 34 61 33 51 32 21 66 12 12 11 62 21 

ROADONETWOEIGHTSTOPKEEPON 

ININDCUWWDSNILVNODLQDTXWS 

12 14 12 14 32 33 22 11 11 32 31 14 12 13 62 14 15 32 13 51 32 21 53 11 31 

EREGIMENTINRESERVESTOPATT 

CLPWVRVSDDTNULQDUHKIRXYIR 

33 13 45 11 52 23 52 31 32 32 21 14 22 13 61 32 22 43 44 12 23 63 54 12 23 

ACKPOSITIONWESTOFCROSSROA 

NGTIWAUUIAAQCQDTV 

14 42 21 12 11 34 22 22 12 34 34 51 33 61 32 21 62 

DONETWOEIGHTSTOP 
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No. 2 

IWILTGSIHWWAffKINDCUWWAXLX 

12 11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32 33 22 11 11 34 53 13 63 

ENEMYINFANTRYREGIMENTHASB 

DIWIRCVNODNGSLNGIGWLVFDWV 

32 12 11 12 23 33 52 14 15 32 14 42 31 13 14 42 12 42 11 13 52 35 32 11 52 

EENOBSERVEDINADEFENSIVEPO 

RVSDDTILLQDUKDWSSHXSENCQD 

23 52 31 32 32 21 12 13 13 51 32 22 44 32 11 31 31 43 53 31 24 14 33 61 32 

SITIONEASTOFGETTYSBURGSTO 

TQGTEUDVQCOIWTXWVRVSDDTNU 

21 61 42 21 24 22 32 52 51 33 IS 12 11 21 63 11 62 23 62 31 32 32 21 14 22 

P Y 0 U W ILLTAKEUPAPOSITIONWE 
LQDUHKIRXYIRNBAYIIIGTEWAY 

13 61 32 22 43 44 12 23 S3 54 12 23 14 41 34 54 12 12 12 42 21 24 11 34 54 

STOFCROSSROADTHREEFOURTHR 

IILffNKIRNGSTLBDDTITILUDVL 

12 12 13 11 14 44 12 23 14 42 31 21 13 41 32 32 21 12 21 12 13 22 32 62 13 

EEANDROADJUNCTIONONEMILES 

VTTAQAVNIIUHQDTXDWYIWXNIN 

62 21 21 34 51 34 62 14 12 12 22 43 51 32 21 53 32 11 54 12 11 63 14 12 14 

OUTHTHEREOFSTOPBEPREPARED 

BDRWSCLPLWAHNTLQDTXCWSCIV 

41 32 23 11 31 33 13 46 13 11 34 13 24 11 63 51 32 21 53 33 11 31 33 12 62 

TOATTACKATDAWNSTOPBATTALI 

DTNILVNODNULQDUBGTEWVRVSD 

32 21 14 12 13 52 14 IS 32 14 22 13 51 32 22 41 42 21 24 11 62 23 62 31 32 

ONRESERVEWESTOFYOURPOSITI 
D T W 

32 21 11 

0 N 


48. Special solution.— a. The preceding example of solution constitutes the general solution 
for this system, since no special conditions are prerequisite to the procedure set forth. An 
interesting solution, however, is that wherein the same message has been cryptographed by two 
different sets of checkerboards. 

b. Suppose, for instance, that in this system two cryptograms of identical lengths and plain 
texts but different cryptographic texts are available for examination. They are superimposed 
and appear as follows; 


No. 1. GCODMGCEGBWILWGMONGBSXOPCNGESFLNI 
No. 2. WILTGSIHWWAWKINDCUWWAXLXDIWIRCVNO 

No. 1. WTMGETLNCGFMDWGXHMGATACTOMSWBLGAI 
No. 2. DNGSLNGIGWLVFDffVRVSDDTILLQDUKDWSS 

No. 1. QPFUAQMSAZPHZGNLMSOWOVXGXHMGATAKN 
No. 2. HXSENCQDTQGTEUDVQCOIWTXIVVRVSDDTNU 

No. 1. OMSffCUSHQLSSTMSUWNNEHUASUWNTGELSS 
No. 2. LQDUHKIRXYIRNBAYIIIGTEWAYIILWNKIR 

No. 1. TMOVCVATAEACOGNLOPHVSVSUNWTWFMSAX 
No. 2. NGSTLBDDTITILUDVLVTQAQAVNIIUHQDTX 













■•'IHST COMPONENTS OF CUYPIOGUAM No. 1 



8MU5-U (nmp.in) 


ItomicH. 
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No. 1. CGUWGXNWTMSSGASNYSGSPDGFMSAXEGASN 
No. 2. DWYIWXNINBDRWSCLPLWAHNTLQDTXCWSCI 


No. 1. MTACWOLNIWDNOMSWKPHUAXHMGATAC 
No. 2. VDTNILVNODNULQDUBGTEWVRVSDDTI 

c. Now consider the first few superimposed letters in these two cryptograms: 


No. 1_GCODMGCEG. . . 

No. 2... .. WILTGSIHW. . . 


Take the pair of superimposed letters GW. The G is the cipher resultant of the recombination of 
two bipartite numerical components that apply to the recomposition checkerboard. The actual 
identities of these numerical components are not known, but, whatever they be, the first of 
them determines the first half of Gc, the second determines the second half of Go. Therefore, for 
cryptanalytic purposes, the actual, but unknown, numerical components may be represented 
by the symbols Gi and G2, the former referring to the row coordinate of the recomposition checker¬ 
board, the latter to the column coordinate. What has been said of the letter G applies also to 
the letter W, the equivalent of G in another checkerboard. It will be found that this manner of 
designating bipartite components by means of subscripts to the letters themselves is a very 
useful method of handling the letters. 

d. Let the first few letters of the two cryptograms be replaced by these same cipher letters 
with their subscripts to indicate components. Thus: 

No. 1. CGCODMGCE 

Components.... CiCj G1G2 CiCj OiOj DiPj MxK^ CriGj C1C2 BiEt 

No. 2. IWILTGSIH 

Components_ Iila WjWj X1I2 LjLg T1T2 G1G2 S1S2 I1I2 H1H2 


Now from the method of encipherment it is clear that C2G1 and I2W1 represent the same plain-text 
letter, since both messages are assumed to contain identical plain texts. That is, C2G1 of crypto¬ 
gram No. l=l2Wi of cryptogram No. 2. Likewise G2Ci=W2l2; C20i=l2Li; 02Di=L2Ti; and so on. 

e. Let all the component pairs of the cryptograms be equated in this manner and let these 
pairs be distributed in a table, such as that shown in %ure 86. It will be seen in figure 86 that, 
for example, A2C1 of cryptogram No. l=T2li and T2N1 of cryptogram No. 2. This means that 
Ii and Ni must represent the same row coordinate of the recomposition checkerboard for crypto¬ 
gram No. 2; w other words I and N must be in the same row in that checkerboard. Again, in figure 
86, it is seen that C2G]=G2Wi and D2W1, which means that G and D must be in the same column in 
that checkerboard. Again, A2Si=W2Ai=S2Ci; this means that A and C are in the same row, W 
and S, in the same column, in the recomposition checkerboard for cryptogram No. 2. All these 
data in figure 86 are studied with the following results: 


In same row: 

(1) I, N, L. W 

(2) A. C. S. D 

(3) Q, V, X, Y 

(4) B, G 


In same column: 

(1) (2) (3) (4) (5) 

T H Y Q U 

W C K B I 

S L D 

R G 

V 


324166—41-11 
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An attempt is nov7 made to bring together these results to reconstruct the recomposition checker¬ 
board for message No. 2. This yields the following: 


2d Component 


u 

K? 

R 

T 

K? 

I 

N 

L 

W 

K? 

D 

A 

C 

s 

K? 

G 

K? 

H 

B 

K? 

V 

Y? 

X 

Q 

Y? 


Fioubi 81a. 


Compare this with the. recomposition checkerboard shown in figure 85 (B). Enough has been 
shown to illustrate the procedure. If there were just a little more text, probably all 26 letters 
of the checkerboard could be definitely placed. 

y. By making a reciprocal table for equivalencies between component pairs in cryptogram 
No. 2, the data obtained would permit of reconstructing the recomposition checkerboard for 
cryptogram No. 1. Having these checkerboards completely or at least partially reconstructed, 
the reconstruction of the decomposition checkerboards is a relatively easy matter and follows 
the procedure described in paragraph 47/. 

g. The complete solution of the two cryptograms, including the decomposition and recom¬ 
position matrices, is as follows: 


2d Component 



1 

2 

3 

4 

5 


1 

2 

3 

4 

5 

1 

R 

E 

F 

L 

G 

1 

W 

A 

"s” 

IT 

I 


T 

I 

N 

G 

P 

1 " 

N 

G 

T 

0 

D 

1 ' 

0 

A 

B 

D 

H 

1 ^ 

C 

B 

E 

F 

K 

« 4 

K 

M 

Ji 

S 

U 

s 4 

L 

_1 

V 

P 

Q 

R 

5 

bd 

W 

X 

Y 

Z 

5 

a 

V 

X 

Y 

Z 


A 


B 


(Decomposition) 


(Becomposition) 


GCODMGCEGBWILWGMONGBSXOPCNGESF 

22 31 24 28 42 22 31 33 22 32 11 18 41 11 22 42 24 21 22 32 13 S3 24 43 31 21 22 33 13 34 

ENEMyiNFANTRYREGIMENTHASBEENOB 

LNIWTMGETLNCGFMDWGXHMGATACTOMS 

41 21 IS 11 23 42 22 33 23 41 21 31 22 34 42 28 11 22 S3 14 42 22 12 23 12 31 23 24 42 13 

SERVEDINADEFENSIVEPOSITIONEAST 

WBLGAIQPFUAQMSAZPHZGNLMSOWOVXG 

11 32 41 22 12 18 44 43 34 81 12 44 42 13 12 88 43 14 88 22 21 41 42 13 24 11 24 82 83 22 

OFGETTYSBURGSTOPYOUWILLTAKEUPA 

XHMGATAKNOMSWCUSHQLSSTMSUWNNEH 

S3 14 42 21 12 23 12 38 21 24 42 13 11 31 81 13 14 44 41 13 13 23 42 13 61 11 21 21 33 14 

POSITIONWESTOFCROSSROADTHREEFO 


■.. II II II II II II II II II II II II II II 


UASUffNTGELSSTMOVCVATAEACOGNLOP 

61 12 13 81 11 21 23 22 33 41 13 13 23 42 24 82 31 82 12 23 12 33 12 31 24 22 21 41 24 43 

URTHREEANDROADJUNCTIONONEMILES 


HVSVSUNWTWFMSAXCGUWGXNWTMSSGAS 

14 62 13 52 13 61 21 11 23 11 34 42 13 12 S3 31 22 61 11 22 S3 21 11 23 42 13 13 22 12 13 

OUTHTHEREOFSTOPBEPREPAREDTOATT 


NYSGSPDGFMSAXEGASNMTACWOLNIWDN 



ENEMYINFANTRYREGIMENTHASBEENOB 


VNODNGSLNGIGWLVFDWVRVSDDTILLQD 


SERVEDINADEFENSIVEPOSITIONEAST 

UKDWSSHXSENCQDTQCTEUDVQCOIWTXW 


OFGETTYSBURGSTOPYOUWILLTAKEUPA 

VRVSDDTNULQDUHKIRXYIRNBAYIIIGT 

62 23 62 31 32 32 21 14 22 13 51 32 22 43 44 12 23 63 64 12 23 14 41 34 54 12 12 12 42 21 

POSITIONWESTOFCROSSROADTHREEFO 

EWAYIILWNKIRNGSTLBDDTITILUDVLV 

24 11 34 54 12 12 13 11 14 44 12 23 14 42 31 21 13 41 32 32 21 12 21 12 13 22 32 62 13 52 

URTHREEANDROADJUNCTIONONEMILES 

TTAQAVNIIUHQDTXDWYIWXNINBDRWSC 

21 21 34 61 34 62 14 12 12 22 43 81 32 21 S3 32 11 64 12 11 63 14 12 14 41 32 23 11 31 33 

OUTHTHEREOFSTOPBEPREPAREDTOATT 

LPLWAHNTLQDTXCWSCIVDTNILVNODNU 

13 45 13 11 34 IS 24 11 63 61 S3 21 83 33 11 31 33 13 62 33 31 14 12 IS 52 14 16 33 14 23 

ACKATDAWNSTOPBATTALIONRESERVEW 

LQDUBGTEWVRVSDDTW 

13 61 32 22 41 43 21 24 11 82 33 52 31 33 32 31 11 

ESTOFYOURPOSITION 






















160 


h. It is seen that the principles elucidated permit of solving this fairly good cipher system 
without recourse to frequency studies and detailed, difficult analytical research. What can be 
done with complete messages of identical texts will give the student a clue to what might be done 
when fairly lengthy sequences of identical plain texts (but not complete messages) are available 
for study. Messages with similar beginnings, or similar endings will afford data for such 
reconstruction. 

49. Periodic fractionating systems.— a. Another type of combined substitution-transposition 
system involving fractionation is that in which the processes involved are applied to groupings 
of fixed length, so that the system gives external evidence of periodicity. One such system, 
commonly attributed to the French cryptographer Dclastelle, is exemplified below. Let the 
bipartite alphabet be based upon the 25-cell substitution checkerboard shown in figure 80. 
Let the message to be enciphered be ONE PLANE REPORTED LOST AT SEA. Let it also be 
assumed that by preagreement between correspondents, periods of 5 letters will constitute the 
units of encipherment. The bipartite equivalents of the plain-text letters are set down vertically 
below the letters. Thus: 


2^ component 

1 2 3 4 5 


M 

A 
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B 
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K 
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0 
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Fioub* 87. 


ONEPL ANERE PORTE DLOST ATSEA 


4 2 2 3 


2 2 6 3 2 


Recombinations are effected horizontally within the periods, by joining components in pairs, 
the first period yielding the pairs 41, 34, 42, 33, 31. These pairs are then replaced by letters 
from tlie original checkerboard, yielding the following; 


ONEPL ANERE 

4 ] 3 4 4 1 1 3 2 3 

23331 23333 

LHOEB MDDEE 


PORTE 

4 4 2 2 3 

3 2 3 2 3 

Q T E R R 


DLOST 

3 4 4 4 2 

2 12 6 2 

H Q T A W 


ATSEA 

1 2 4 3 1 

2 2 6 3 2 

A P A G D 


b. A different checkerboard may, of course, be employed for the recomposition process. 
Also, periods of any convenient length may be employed; or, in a complicated case, periods of 
varying lengths may be employed in the same cryptogram, according to some prearranged key. 

60. General principles underlying the solution.— a. It will be noted that the periods in the 
foregoing example contain an odd number of letters. The result of adopting odd-length periods 
is to impart a much greater degree of cryptographic security to the system than is the case when 
even-length periods are involved. This point is worth while elaboratir^ upon to make its crypt- 
analytic significance perfectly clear. Note what happens when an even period is employed: 

ONEPLA NEREPO RTEDLO ... 


2 2 3 3 4 4 

3 2 3 2 1 2 


LHLREA NRQEED TEQDDA 


HI 



Now if each 6-letter cipher group is split in the middle into two sections and the letters are taken 
alternately from each section (Ex. LHLREA=LRHELA) the results are exactly the 


same as would be obtained in case a simple digraphic encipherment were 
to be employed with the 2-square checkerboard shown in figure 88. 
For example, 0Np=LRo; EPp=HEci and so on. Encipherment of this 
sort brings about a fixed relationship between the plain-text digraphs 
and their cipher equivalents, so that the solution of a message of this 
type falls under the category of the cryptanalysis of a case of simple 
digraphic substitution, once the length of the period has been estab¬ 
lished.® The latter step can readily be accomplished, as will be seen 
presently. In brief, then, it may be said that in this system when 
encipherment is based upon even periods the cipher text is purely 
and simply digraphic in character, each plain-text digraph having 
one and only one cipher-text digraph as its equivalent. 

b. But the latter statement is no longer true in the case of odd 
periods. Note, in the example under paragraph 49o, that the cipher 
equivalent of the first plain-text digraph of the first group, ON, is 
composed of the initial and final components of the letter L^, the 
final component of the letter Oc, and the initial component of the 
letter Le. That is, three different plain-text letters, L, 0, and E, are 
involved in the composition of the cipher equivalent of one plain-text 
digraph, ON. Observe now, in the following examples, that variants 
may be produced for the digraph ONp. 


M 

A 

N 

U 

F 

C 

T 

R 

I 

G 

B 

D 

E 

H 

K 

L 

0 

P 

Q 

S 

V 

W 

X 

Y 

Z 

M 

c 

B 

L 

V 

A 

T 

D 

0 

W 

T 

R 

E 

P 

X 

U 

I 

H 

Q 

Y 

F 

G 

K 

s 

Z 


ON E P LANE 
LR HE LA NE 

Fioubx 88. 


LH OE B 

( 1 ) 


2 3 2 4 3 

LR ^ P 

( 2 ) 


1 2 3 4 6 

ON CR U 

4 1 2 2 1 

2 3 13 4 

LT M H 

(3) 


PR fiN G 

4 2 4 1 2 

3 3 2 8 6 

OL R D K 
■( 4 ) 


CO NT I 


lA CR I 

(5) 


1 2 3 4 6 

PO NQ I 

4 4 12 2 

3 2 8 6 4 

SA RR Y 

( 6 ) 


1 2 3 4 6 

AT 1 0 N 

1 2 2 4 1 

2 2 4 2 3 

AI AI R 

(7) 


e. The foregoing examples fall into two classes. In the first, where the 0 of ONp falls in an 
odd position in the period, the first letter of the trigraphic cipher equivalent must be an L*, the 
second must be one of the 5 letters in the second column of the substitution checkerboard, the 
third must be one of the 5 letters in the third row of the checkerboard. Therefore, L, may 
combine with 5X5 or 25 pairs of letters to form the second and third letters of the 3-letter equiva¬ 
lent of ONp. In the other dass, where the 0 of ONp falls in an even position in the period, the 
first letter of the equivalent must be one of the 5 letters in the fourth column of the checkerboard, 
the second must be one of the 5 letters in the first row, and the third letter must be Rp. There¬ 
fore, Rp may combine with 5X5 or 25 pairs of letters to form the first and second letters of the 
3-letter equivalent of ONp in this position in the period. Hence, ONp may be represented by 50 
trigraphic combinations; the same is true of all other plain-text digraphs. Now if the system 
based upon even periods is considered as a simple digraphic substitution, the foregoing remarks 
lead to characterizing the system based upon odd periods as a special type of digraphic sub¬ 
stitution with variants, in which 3 letters represent 2 plain-text letters. 


» An example of the solution of a cryptogram of this type was given in Military Cryptaruaysia, Part I, 
sec. IX. 
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d. However, further study of the odd-period system may show that there is no necessity for 
trying to handle it as a digraphio system with variants, which would be a rather complex affair. 
Perhaps the matter can be simplified. Befening again to the example of encipherment in 
paragraph 49 a: 

ONEPL ANERE PORTE DLOST ATSEA 


2 3 3 3 1 


2 3 3 3 3 


LHOEB MDDEE QTERR HQTAW APAGD 
Now suppose that only the cipher letters are at hand, and that the period is known. The first 
cipher letter is L, and it is composed of two numerical bifid components that come from the first 
and second positions in the upper row of components in the period. These components are not 
known, but whatever they are the first of them is the first component of L, the second of them 
is the second component of L. Therefore, just as in paragraph 48c, the actual but unknown, 
numerical components may be represented by the symbols Li and L2, the former referring to the 
row coordinate of the substitution checkerboard, the latter to the column coordinate. The 
same thing may be done with the components of the second cipher letter, the third, fourth, and 
fifth, the respective components being placed into their proper positions in the period. Thus: 


Cipher. 

Components, 


LHOEB 
Li Ls Hi H* 0i 
0] El Ej Bi B 2 


Now let the actual plain-text letters be set into position, as shown at the right in the two dia¬ 
grams below. 


Plain text. 

Components- 
Cipher. 


ONEPL 
(41344 
12 3 3 3 1 

LHOEB 


ONEPL 
Li L, Hi H 2 0i 

Oi El E2 Bi B2 
LHOEB 


By comparing the two diagrams it becomes obvious that Li, H2, and 0] all represent the coordinate 
4; Hi, El, E2, and Bi all represent the coordinate 3, and so on. If this equivalency were known 
for all the 50 combinations of the 25 letters with subscript 1 or 2 there would be no problem, 
for the text of a cryptogram could be reduced to 25 pairs of digits representing monoalphabetic 
encipherment. But this equivalency is not known in the case of a cryptogram that is to be 
solved; basically the problem is to establish the equivalency. 


e. It is obvious that the vertical pair of components ^ represents Op, the vertical pair 
represents Np, and so on. The complete example therefore becomes: 


El 


Components.. 

I Li L* H, H2 0i 

Ml M2 Di D2 Di 

Qi Qs Ti T2 El 

Hi H2 Qi Q2 Ti 

Ai A* Pi P2 Ai 

i02EiE,B,B, 

D2 El E2 El E2 

E2 Ri R2 Ri R2 

T2 Ai A2 ffi Vi 

A2 Gi G2 Di D2 

Cipher_ 

—L H 0 E B 

MDDEE 

QTERR 

HQTAW 

APAGD 


y. Note that a plain-text letter in an odd position in the period has its components in the order 
@162; in an even position in the period the components of a plain-text letter are in the order 6261. 

For example, note the Op in the first period period This 


distinction must be retained since the component indicators for rows and columns are not inter¬ 
changeable in this system. From this it follows that the vertical pairs of components represent¬ 
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ing a given plain-text letter are of two classes: 0i02 and 020i, and the two must be kept separate 
in cryptanalysis. 

g. Now consider the equivalent of Op in the first period. It is composed of ^ This is 

only one of a niunber of equivalents for Op in an odd position in the period. The row of the sub¬ 
stitution checkerboard indicated by L, may be represented by 4 other components, since that 

row contains 5 letters. Therefore the upper component of the equivalent of Op may be any 

one of 5 letters. The same is true of the lower component. Hence, Op in an odd position in the 
period may be represented by any one of 5X5=25 combinations of vertical components in the 
sequence 0i->02. Op in an even position in the period may be represented by any one of a similar 
number of combinations of vertical components in the reverse sequence, 02-»0i. Thus, dis¬ 
regarding the position in the period, this system may be described as a monoalphabetic sub¬ 
stitution with variants, in which eveiy plain-text letter may be represented by any one of 50 
different component-pairs. But in studying an actual cryptogram in this system, since the 
position (odd or even) occupied by a cipher letter in the period is obvious after the length of the 
period has been established, a proper segregation of the cipher letters wiU permit of handling the 
cipher letters in the two classes referred to above, in which case one has to deal with only 25 
variants for each plain-text letter. Obviously, the 25 variants are related to one another by 
virtue of their having been produced from a single enciphering matrix of but 25 letters. This 
relationship can be used to good advantage in reconstructing the matrix in the course of the 
solution and the relationship will be discussed in its proper place. 

A. Now if the foregoing encipherment is studied intently several important phenomena may 
be observed. Note, for instance, how many times either the 0i or the 02 component coincides 
with the plain-text letter of which it is a part. In the veiy first period the Op has an O2 under it; 
in the "ftTWA period the Ep has an E2 under it. The same phenomenon is observed in colu^s 
3 and 5 of the second period, in column 3 of the tliird period, and in column 1 of the fifth period. 
In column 5 of the third, fourth, and fifth periods the 0i components coincide with the respec¬ 
tive plain-text letters involved. There are, in this short example, 9 cases of this sort, giving 
rise to instances of what seems to be a sort of self-encipherment of plain-text letters. How does 
this come about? And is it an accident that all these cases involve plain-text letters in odd 
positions in the periods? 

i. If the periods in the foregoing example in subparagraph e are studied closely, the following 
observations may be made. Because of the mechanics of encipherment in this system the first 
cipher letter and the first plain-text letter in each period must come from the same row in the 
substitution checkerboard. Since there are only 5 letters in a row in the checkerboard the proba¬ 
bility that the two letters referred to will be identical is 1/5. (The identity will occur every time 
that the coordinate of the row in which the second plain-text letter stands in the checkerboard is 
the same as the coordinate of the column in which the first plain-text letter stands.) The same 
general remark applies to the second cipher letter and the third plain-text letter; as well as to 
the third cipher letter and the fifth plain-text letter: In these cases the two letters rnust come 
from the same row in the checkerboard and the probability that they will be identical is likewise 
1/5. (The identity in the former case will occur every time that the coordinate of the row in 
which the fourth plain-text letter stands in the checkerboard is the same as that of the column 
in which the third plain-text letter stands; in the latter case the identity will occur every time 
that the coordinate of the column in which the first plain-text letter stands is the same as that 
of the column in which the fifth plain-text letter stands.) The last of the foregoing sources of 
identity is exemplified in only 4 of the 9 cases mentioned in subparagraph A above. These 
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involve the fifth plain-text letter in the third, fourth, and fifth periods, and the first letter in the 
fifth period, wherein it will be noted that the 0i component standing directly under the plain¬ 
text letter is identical with the latter in each case. 

j. But how are the other 5 cases of identity brought about? Analysis along the same 
lines as indicated above will be omitted. It will be sufficient to observe that in each of those 
cases it is the 0a component which is identical with the plain-text letter involved, and again the 
probability of the occurrence of the phenomenon in question is 1/5. 

k. Since the probability of the occurrence of the event in question is 1/5 for 0, components 
and 1/5 for 03 components, the total probability from either source of identity is 2/5. This 
probability applies only to the letters occupying odd positions in the period, and it may be said 
that in 40 percent of all cases of letters in odd positions in the periods the one or the other of the 
two cipher components will be identical with the plain-text letter. 

l. As regards the plain-text letters in even positions, analysis will show why only in a very 
few cases will either of the cipher components coincide with the plain-text letter to which they 
apply, for the method of finding equivalents in the substitution checkerboard is to take the 
first component as the row coordinate indicator and the second component as the column indi¬ 
cator; a reversal of this order will give wholly different letters, except in those 5 cases in which 
both components are identical. (The letters involved are those which occupy the 5 cells along 
the diagonal from the upper left-hand comer to the lower right-hand comer of the checkerboard.) 
Now in every case of a letter in an odd position in a period the two vertical components are in 
the 0102 order, corresponding to the order in which they are normally taken in finding letter 
equivalents in the checkerboard. But in every case of a letter in an even position in a period, 
the two vertical components are in the order 020i, which is a reversal of the normal order. It 
has been seen that in the case of letters in odd positions in the periods the probability that one 
of the components will coincide with the plain-text letter is 40 percent. The reasoning which led 
to this determination in the case of the odd letters is exactly the same as that in the case of letters 
in even positions, except that in the final recomposition process, since the components in the 
even positions are in the 020i order, which is the reverse of the normal order, identity between 
one of the components and the plain-text letter can occur in only 1/5 of the 40 = 8 percent of 
the cases. It may be said then that in this system 48 percent of all the letters of the plain text 
will be “self-enciphered” and represented by one or the other of the two components; in the 
case of the letters in odd positions, the amount is 40 percent, in the case of letters in even posi¬ 
tions, it is 8 percent. 

m. Finally, what of the peculiar phenomenon to be observed in the case of the first column 
of the fifth period of the example in subparagraph e? Here is a case wherein the plain-text 
value of a pair of superimposed components is unmistakably indicated directly by the cipher 
components themselves. Studying the cipher group concerned it is noted that it contains 
2 Ao’s separated by one letter, that is, the A’s are 2 iutervals apart. This situation is as though 
the plain-text letter were entirely self-enciphered in this case. Now it is obvious that tMs 
phenomenon will occur in the case of periods of 5 letters every time that within a period a cipher 
letter is repeated at an interval of 2, for this will bring about the superimposition of a 0i and 0a 
with the same principal letter and therefore the plain-text letter is indicated directly. This 
question may be pertinent: How many times may this be expected to happen? Analysis along 
the lines already indicated will soon bring the answer that the phenomenon in question may be 
expected to happen 4 times out of 100 in the case of letters in odd positions and only 8 times out 
of 1,000 in the case of letters in even positions. In the latter cases the letters involved are those 
falling in the diagonal sloping from left to right in the substitution matrix. 
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n. All of the foregoing phenomena will be useful when the solution of an example is under¬ 
taken. But before coming to such an example it is necessary to explain how to ascertain the 
period of a cryptogram to be solved. 

61. Ascertaining the length of the period.— a. There are several methods available for 
ascertaining the length of the period. The simplest, of course, is to look for repetitions of the 
ordinary sort. If the period is a short one, say 3, 5, 7 letters, and if the message is fairly long, the 
chances arc good that a polygraph which occurs several times within the message will fall in 
homologous positions within two different periods and therefore will be identically enciphered 
both times. There will not be many such repetitions, it is true, but factoring the intervals 
between such as do occur will at least give some clue, if it will not actually disclose the length of 
the period. For example, suppose that a 7-letter repetition is found, the two occurrences being 
separated by an interval of 119. The factoi-s of 119 are 7 and 17; the latter is unlikely to be the 
length of the period, the former, quite likely. 

h. If a polygraph is repeated but its two occurrences do not fall in homologous positions in 
two periods, there wiU still be manifestations of the presence of repetition but the repeated letters 
will be separated by one or more intervals in the periods involved. The number of repeated 
letters will be a function of the length of the polygraph and the length of the period; the interval 
between the letters constituting the repetition will be a function of the length of the period and 
the position of the repeated polygraph in two periods in which the two polygraphs occur. Note 
what happens in the following example: 


SENDTHR EEMENDO WNTOEND OFENDIC OTTROAD 

-«aio«9A 9^12134 5124313 4131322 4222418 

J I 3 2 2 4 3 3 8 1 3 3 2 2 2 3 2 2 3 3 2 2 6 3 8 2 4 1 2 2 2 3 2 2 2 

PNRGETP ENNPBET VIBDDRD LBDTXDL OTLDTDT 


Cryptogram 


PNRGE TPENN PBETV IBDDR DLBDT XDLOT LDTDT 
Here the plain text contains the trigraph END 4 times. The ENDp in the first period gives rise to 
the cipher letters . N . . E . .; in the second period this trigraph also produces 

! ! N ! ! E ! The interval between the Ne and the E, is 3 in both cases. Two times this 
interval plus one gives the length of the period. In this case the initial letter of the repeated 
trigraph falls in an even position in the period in both occurrences. The ENDp in the third period 

1 2 3 4 6 6 7 

gives rise to the cipher letters . . B . . . D; in the fourth period it also produces 

! B ! ! ! D ! The interval between the Bo and the D, is 4 in both cases. Two times this 
interval minus one gives the length of the period. In this case the initial letter of the repeated 
trigraph falls in an odd position in the period in both occurrences. 

c. The foregoing properties of repetitions in this system afford a means of ascertaining the 
length of the period in an unknown example. First, it is evident that a repeated trigraph in the 
plain text produces two different pairs of cipher equivalents according to whether the initial 
letter of the trigraph occurs in an odd or an even position in the period. The two letters con¬ 
stituting the repetition in the cryptogram will not be sequent but will be separated by an interval 
of 1, 2, 3, . . . letters depending upon the length of the period. This interval, however, is half 
of the period plus or minus one.* Conversely, if in a cryptogram there are repetitions of pairs of 
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letters separated by an interval *, it is probable that these repetitions represent repetitions of 
plain-text trigraphs which occupy homolc^ous positions in the period. The interval x (between 
the letters constituting the repetition in the cipher text) then gives a good clue to the length of 
the period: |>(length of period) =2a;±l. 

d. A special kind of index is prepared to facilitate the search for repetitions of the nature 
indicated. If tabulating macbinery is available, an alphabetically arranged index showing say 
10 succeeding letters after each A,, Bo, C,, . - - Z* is prepared for the cryptogram. Then this 
index is studied to see how many coincidences occur at various intervals under each letter. For 
example, under A, one looks to see if there are 2 or more cases in which the same letter appears 
2, 3, 4, . . . intervals to the right of A, a record being kept of the number of such cases under 
each interval. The same thing is done with reference to Bo, Co, and so on. The tallies represent¬ 
ing coincidences may be amalgamated for all the letters A, B, C, . . . Z, only the intervals being 
kept segregated. When tabulating machineiy is not available, the search for repetitions ma}^ be 
made by transcribing the cryptogram on two long strips of cross-section paper, juxtaposing the 
strips at A, B, C, . . . Z, and noting the coincidences occurring 1, 2, 3, . . . up to say 10 letters 
beyond the juxtaposed letters. For example, b^inning with Ao, the two strips are juxtaposed 
with the first A on one against the first A on the other. Note is made of any coincidences found 
within 10 letters beyond the A’s, and a record is kept of such coincidences according to intervals. 
Keeping one strip in position the other is slid along to the second A, and again coincidences are 
sought. All the A’s are treated in this way, then the B’s, C’s . . . Z’s. The record made of the 
coincidences may consist merely of a tally stroke written imder the intervals 1, 2, 3, . . . 10. 
That interval which occurs more frequently than all the others is probably the correct one. This, 
interval times 2, plus or minus 1 is the length of the period. There are, therefore, only two alter¬ 
natives. A choice between the two alternatives may then be made by transcribing the text or 
a portion of it according to each hypothesis. That transcription which will most often throw 
the two members constituting a repetition into one and the same period is most likely to be 
correct. 

e. Finally, for ascertaining the period there is one method which is perhaps the most labori¬ 
ous but surest. It has been pointed out that this system reduces to one that may be described 
as monoalphabetic substitution with variants. If the cipher text is transcribed into 0, and 02 
components according to various assiuned periods, and then a frequency distribution is made of 
the pairs of vertical components for each hypothesis, that period which gives the best approxi¬ 
mation to the soiii of distribution to be expected for a system of monoalphabetic substitution 
with 25 variants for each letter may be taken to be correct. For in the case of an incorrect period 
the resultant vertical bipartite components are not the equivalents of the actual plain-text 
letters; hence such repetitions as occur are purely accidental and the number of such cases would 
be rather small. But in the case of the correct period the resultant vertical pairs of components 
are the equivalents of the actual plain-text letters; hence repetitions are causal and fairly fre¬ 
quent. Were it not for variants, of course, the distribution would be perfectly monoalphabetic. 
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52. niustratioii of solution.—a. With the forcing principles in mind, the following cryp¬ 
togram will be studied: 

KZFBE ILYYM OCBRB LZDOT GBLPK YWCUC CEPQL 

AMEYL ZQXWH LRWQY DRWBM TIZEB ELAYE SOBRY 

QVBBL YXNAB QBDOY MQDLW LNACO XCRRG ASWQB 

FDDTE BAMFD ETENA KGDFO QDUBN DCLYD VWBAX 

CAUGG XOART X XTSD AYXHK OLSXA BRKRP UZWHO 

MTDHT SGMLS LQPOU NHCIC KKAQB DOFLE KAPRG 

SXUPO WALMA VQHLM LAXKP WSTMC XKQVH SIXSL 

LWXLX RSGZD FKLNY BXMRB NADKT TBAEO BHWVL 

YSXMB OWPGX KORZI UCEAD YIDBL ZMITA NHCAI 

DNCID DOYIB CNOLY UUMCE POTDM GBFUN AHLBD 

WXNXK KCSCT 0 XTSD AYXHK CNLDK RRFAY APMHC 

ANMBV GREZQ ATCYI MNDLR LGMTW ETRCV VKTED 
UFDEL XHEQV CBLYU DUGYA FHNQL KFRUC NVDLH 

L Z D R E L K XKU PSEMC TNKTK EBOEE PGVQT GWERH 

L Z D R E L K FAX lYDAK ZLXXO RRPER RRRNC IE 

b. The long repetitious noted in the text (interval8=210 and 35) indicate a period of either 
5 or 7. By transcribing several lines of text into their 01 and 0* components according to both 
of these alternatives and distributing the vertically superimposed pairs, it is soon found that a 
period of 7 produces many more repetitions than does a period of 5. The entire text is then 
transcribed into its 0i and 0j components according to a period of 7 (see fig. 89) and complete 
distributions of 0i02 and 020i vertical pairs are made, the distributions being, of course, kept 
separate. They are shown in figures 90 and 91. The individual distributions sliow many 
repetitions and the distributions as a whole are very favorable for a period of 7. 

I 2 3 4 5 

K Z F B E I L Y Y M 0 C B R B L Z D 0 T G B L P K Y W C U C C E P Q L 

Ki K* Zi Zj F, Fj Bi Yi Y, Yi Y, Ml Ms 0i Bi B, Lj L, Zi Z, Di B, B, Li L, Pi P, Ki Ui U* Ci C* Ci C, Ei 

Bs El E* Ii Is Li Ls Os Cl Cs Bi B, Ri R, Ds 0i Os Ti T* Gi G, K, Yi Y, Wi W, Ci Cs E* Pi Ps Qi Qs Li L, 

6 7 8 9 10 

A M E Y L Z Q X W H L R W Q Y D R W B M T I Z E B E L A Y E 5 0 B R Y 

Ai As Ml Ms El Es Yi Xi X, Wi W, Hi Hs Li Yi Y, Di D* Ri Rs Wi Ii I, Zj Z* Ei Es Bi Yi Ys Ei E* Si S* 0i 

Ys Li Ls Zi Zs Qi Qs Ls Ri Rs Wi Ws Qi Qs Ws Bi Bs Mi Ms Ti T, B* Ei E* Li L* Ai As Os Bi B* Ri R* Yi Yj 

II 12 13 14 15 

QVBBLYX NABQBDO YMQDLWL NACOXCR RGASWQB 

Qi Qs Vi Vs Bi Bs Bi Ni Ns Ai As Bi Bs Qi Yi Ys Mi Ms Qi Qs Di Ni Ns Ai As Ci Cs 0i Ri R* Gi Gs Ai As Si 

Bs Li Ls Yi Ys Xi Xs Qs Bi Bs Di Ds 0i 0, Ds Li Ls Wi Ws Li L, 0, Xi X, Ci Cs Ri Rs Ss Wi W* Qi Qs Bi Bs 

16 17 18 19 20 

FDDTEBA MFDETEN AKGDFOQ DUBNDCL YDVWBAX 

Fi Fs Di Ds Di Ds Ti Mi Ms Fi F* Di D* Ei Ai As Ki K, Gi G, Di D, Ds Ui U* Bi B* Ni Yi Y, Di Ds Vi Vs Wi 

Ts El Es Bi Bs Ai As Es Ti Ts Ei Es Ni Ns D, Fi Fs 0i Os Qi Qs Ns Di Ds Ci Cs Li L* Ws Bi Bs Ai As Xi Xs 
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21 22 23 24 25 

C A U G G X 0 A R T X X T S D A Y X H K 0 L S X A B R K R P U Z W H 0 

Cl Cj A, As Ui Uj Gi fti As Ri Rs Ti T, Xi Di Dj A, A, Yi Y, Xi L, Ls S, S, X, Xs A, Ri Rs Pi Ps Ui U* Zi 

Gs Gi G* Xi Xs Oi 0* Xs Xi Xs Ti Ts Si S, X, Hi H, K, K, 0, 0, As Bi Bs Ri Rs Ki K, Zs Wi Ws Hi H* 0, 0* 

26 27 28 29 30 

MTDHTSG MLSLQPO UNHCICK KAQBDOF LEKAPRG 
Mi Ms Ti T, Di D, H, Mi M* Li L, Si Ss Li Ui Us N, N, H, Hs C, K, Kj A, As Qi Q, Bi Li L, Ei E, Ki K, Ai 

H, T, Ts Si S, G, G, L, Qi Q, P, P, 0, 0, Cs Ii Is Ci C* K, Ks Bs D, Ds 0, 0, Fi F, A, Pi P, Ri R* G, G, 

31 32 33 34 35 

SXUPOWA LMAVQHL MLAXKPW STMCXKQ VHSIXSL 

S, Ss X, Xs Ui Us Pi Li Ls Ml Ms Ai As V, Mi Ms Li Ls Ai Aj Xi Si Ss Ti T, Mi Ms Ci Vi Vs Hi Hs Si S, Ii 

Ps Oi Os Wi Ws Ai A, Vs Qi Qs Hi Hs Li Ls X, Ki Ks Pi P, Wi Ws Cs Xi Xs Ki Ks Q, Q, Is Xi Xs Si S, Li Ls 

36 37 38 39 40 

L W X L X R S G Z D F K L N Y B X M R B N A D K T T B A E 0 B H W V L 

Li Ls Wi Ws Xi Xs Li Gi G* Zi Zs Di Ds Fi Yi Ys Bi Bs Xi Xs Mi Ai As Di Ds Ki Ks Ti Ei Es Oi 0, Bi Bs Hi 

Ls Xi Xs Ri Rs Si Ss Fs Ki Ks Li Ls Ni Ns Ms Ri Rs Bi B, Ni Ns Ts T, Ts Bi Bs A, Aj Hs Wi Ws Vi V* L, U 

41 42 43 44 45 

YSXMBOW PGXKORZ lUCEADY IDBLZMI TANHCAI 

Yi Ys Si Ss Xi Xs Ml Pi Ps Gi Gs Xi Xs Ki Ii Is Ui Us Ci Cs E, Ii Is Di Ds Bi Bs Li Ti Ts Ai As N, Ns H, 

Ms Bi Bs Oi Os Wi Ws Ks Oi Os R, Rs Zi Zs Es Ai As Di Ds Yi Ys Ls Zi Zs Mi Ms Ii Is Hs Ci Cs A, As Ii I* 

46 47 48 49 50 

D N C I D D 0 Y I B C N 0 L Y U U M C E P 0 T D M G B F U N A H L B D 

D, Ds Ni Ns Cl Cs Ii Y, Ys Ii Is Bi Bs Cl Yi Ys Ui Us Ui Us Mi Oi Oj Ti Ts Di Ds Mi U, Us Ni Ns Ai As Hi 

Is Di Ds Di Ds Oi Os Cs Ni Ns Oi Os Li Ls Ms Ci Cs Ei Es Pi Ps Ms G, Gs Bi Bs F, Fs Hs Li Ls B, Bs Di D, 

51 52 53 54 55 

WXNXKKC SCTOXTS DAYXHKC NLDKRRF KYAPMHC 

Wi Ws Xi Xs Ni Ns Xi Si Ss Cl Cs Ti Ts Oi Di Ds Ai As Yi Ys X, Ni Ns Li L, Di Ds Ki Ki Ks Yi Y, Ai As P, 

Xs Ki Ks Ki Ks Cl Cs Os Xi X* Ti Ts Si Ss Xs Hi Hs Ki Ks Ci Cs Ks Ri Rs Ri Rs Fi F, Ps Mi Ms Hi H, C, Cs 

56 57 58 59 60 

A N M B V G R E Z Q A T C Y I M N D L R L G M T W E T R C V V K T E D 

Ai As Ni Ns Ml Ms B, Ei E* Zi Zs Qi Qs Ai Ii Is Mi Ms Ni Ns Di Gi Gs Mi Ms Ti T, W, Ci Cs Vi Vs Vi Vs 

Bs Vi Vs Gi Gs Ri Rs As Ti Ts Cl Cs Yi Ys Ds Li Ls Ri Rs Li Ls W, Ei E, Ti Ts Ri Rs Ks Ti Ts Ei Ej Di 

61 62 63 64 65 

U F D E L X H E Q V C B L Y U D U G Y A F H N Q L K F R U C N V D L H 

Ui Us Fi F, Di Ds E, El Es Qi Qs Vi Vs Cl Ui Us Di Ds Ui U, Gi Hi H, Ni Ns Qi Qs Li Ui Us Ci Cs Ni Ns V, 

Es Li L, Xi X, Hi H, C, Bi B, Li L, Yi Ys Gs Yi Y, Ai As Fi Fs Ls Ki Ks Fi Fs Ri Rs V, Di D, L, Ls Hi Hs 

66 67 68 69 70 

L Z D R E L K X K U P S E M C T N K T K E B 0 E E P G V Q T G W E R H 

Li Ls Zi Zs Di Ds Ri Xi Xs Ki Ks Ui Us Pi Ci Cs Ti Ts Ni Ns Ki Bi Bs Oi Os Ei Es Ei Qi Qs Ti T* Gi Gs Wi 

Rs El Es Li Ls K, K, Ps Si Ss Ei Es Mi M, Ks T, Ts Ki Ks Ei Es Es Pi Ps G, Gs Vi Vs Ws Ei E, Ri Rs H, H, 

71 72 73 74 75 

L Z D R E L K F A X I Y D A K Z L X X 0 R R P E R R R R N C I E 

Li Ls Zi Zs Di Ds Ri Fi Fs Ai As Xi Xs Ii Ki Ks Zi Zs Li L* Xi Ri Rs Pi P* Ei Es Ri Ni Ns C, Cs 

Rs El Es Li Ls Ki Ks I* Yi Ys Di D* Ai As X* Xi X* Oi Os Ri Rs Rs Ri Rs Ri Rs Ri Rs Ii Is Ei E* 


Figubi 80—Oonttnued. 
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c. The text now being transcribed into periods of 7, with the 0i and 63 components indicated 
by the cipher letters in each period, the vertical pairs of components are examined to locate 
coses in which the basic letters of the 0i and 0s superimposed components are identical, where¬ 
upon the plain-text letters indicated are at once inserted into position. In this example 10 
such cases are found, one each in periods 14, 22, 26, 35, 36, 52, 59, 68, and two in period 74. 
All of these, of course, involve letters in odd positions in the periods. The plain-text letters 
thus inserted may serve as clues for assuming probable words. 

d. Now if only a few equivalencies can be established between a few of the 0i components, 
or between a few of the 0s components, or between a few 0i and 02 components, a long step for¬ 
ward may be taken in the solution. Perhaps some information can be found by studying 
figures 90 and 91. A consideration of figure 90 will soon h'ad to the idea that each row of fre¬ 
quencies can indicate only 5 different plain-text letters, one of which coincides with the indicating 
letter at the left of the row. Moreover, in this same figure, while there are 25 rows in aU, there 
are really only 5 different categories of rows, each category corresponding to a row in the 
substitution checkerboard. 

e. To explain quite clearly what is meant and how the principle can be employed in this case, 
assume that figure 90, instead of applying to an unknown checkerboard, applied to a known 
one, say that shown in figure 87. The bipartite coordinates and the letters which would occupy 
the cells are as seen in figure 92: 

21 12355445113234352412345 
ABCDEFGHIKLMNOPQRSTUVWXYZ 


3 

2 

3 

3 


2 

3 

2 

3 

4 


4 

4 

4 

2 

4 
2 
1 

5 
5 
5 
5 
5 


aIaImIm anffuufmmnanunfaumanuf 
bdbbdekkhhkbbedehekdhbdehk 
c RGGIIGCCRTRIRGTICTRIG 
D d"b"T'd"e' kkhhkbbedehekdhbdehk 
bdbbdekkhhkbbedehekdhbdehk 
fTmmanffuufmmnanunfaumanuf 

G T C CTRGGIIGCCRTRIRGTICTRIG 
H d"b""b“F ekkI^hkb'b'edehekdhbdehk 
I t'T'c'T r'TTTT gcTrtrirgtictrig 
kdbbdekkhhkbbedehekdhbdehk 

L O'TTTT PSSQQSLLPOPQPSOQLOPQS 
MAMMANFFUUFMMNANUNFAUMANUF 
NAMlSrANFFUUFMMNANUNFAUMANUF 
O^LirOPSSQQSLLPOPQPSOQLOPQS 
POLLOPSSQQSLLPOPQPSOQLOPQS 
QOLLO PSSQQSLLPOPQPSOQLOPQS 
RTCCTRGGIIGCCRTRIRGTICTRIG 

so'lTopssqqsllpopqpsoqlopqs 

ttcctrggiigccrt'rirgtictrig 

UAMMANFFUUFMMNANUNFAUMANUF 
VWVVWXZZYYZVVXWXYXZWYVWXYZ 
W ¥T VWXZZYYZVVXWXYXZWYVWXYZ 
X ¥ T VWXZZYYZVVXWXYXZWYVWXYZ 
Y ¥TT WXZZYYZVVXWXYXZWYVWXYZ 
ZWVVWXZZYYZVVXWXYXZWYVWXYZ 

Fioube 
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Now consider the A row and the F row. The 26 letters in both rows of cells are, from the very 
nature of the system, identical in their sequence and there are only 5 different letters involved, 
each appearing 6 times. Therefore it would seem that frequency distributions corresponding to 
these rows sliould show definite characteristics by means of which they could be compared 
statistically. Furthermore, the 0i coordinates applying to these two rows, Aj and Fi, indicate 
that A and F are in the same row in the checkerboard. What has been said of the A and F rows 
also appliea to the M, N, and U rows, for the letters A, F, M, N, and U are all in the same row in the 
checkerboard (fig. 87). Perhaps a statistical test can be applied to ascertain wliich rows of 
distributions in figure 90 are similar and this in turn may give clues to the letters which fall in 
the same row in the checkerboard applicable to the problem in hand. 

y. Again, consider the columns in figure 90. What has been said of the rows applies equally 
to the columns, and therefore the same sort of test may also be applied to the columns of figure 
90 for clues as to the composition of the columns of the checkerboard applicable to the problem 
under consideration. If there were sufficient text much of the labor of solving such cases would 
be reduced to a matter of statistical analysis. But what sort of statistical test should be used? 
Obviously it should be one based upon “matching” the distributions of figure 90, but specifically 
what should it be? Note the distributions in rows D and M; they appear to be similar. Is it 
correct to apply the usual x-test for matching two frequency distributions? Consider the com¬ 
position of the rows of figure 90, and specifically consider the A and F rows, composed as follows: 


A.... AMMANFFUUFMMNANUNFAUMANUF 

F. AMMANFFUUFMMNANUNFAUMANUF 


Here the letters in opposite cells are identical and there are only 5 different letters involved: 
A, M, N, F, and U. Of these only 3 are high-frequency letters in normal plain text; 2 are of medium 
to low frequency. But the high-frequency letters in the A row match those in the F row, the 
low-frequency letters in the A row also match the low-frequency letters in the F row. Hence, 
if frequency distributions corresponding to these rows are tested statistically, they should yield 
a fairly high index of coincidence. But should the constant .0667 (probability of monographic 
coincidence in normal English text) beused in the test? Obviously not, for this constant is derived 
from statistics based upon the normal frequencies of all 26 letters of the alphabet, whereas here 
only 5 letters are involved and the exact 5 involved in any example is determined by the compo¬ 
sition of the checkerboard. Again, consider the A and C rows of figure 90, composed as follows: 


A. AMMANFFUUFMMNANUNFAUMANUF 

C_ TCCTRGGIIGCCRTRIRGTICTRIG 


Here is a case where, by chance, high-frequency letters stand opposite high-frequency letters 
(A and T, N and R); medium-frequency letters stand opposite medium-frequency letters (M and 
C, F and G). The only case of fairly marked difference is in that of the pairing of U and I. 
Hence, a statistical matching of frequency distributions applying to these two rows would be 
apt to yield a high index of coincidence. Yet, these two rows do not belong together and to 
assume that the letters A and C belong in the same row in the checkerboard would block or at 
least retard solution. In spite of the foregoing reasoning, there nevertheless remains the feeling 
that a statistical matching of the rows should be possible or should at least offer some clues as 
to the composition of the checkerboard. 

g. In applying the usual x-test for matching two distributions use is made of the important 
constant .0667, the probability of monographic coincidence for normal English text. This 
constant may be modified to meet the special conditions of the present problem. If it be assumed 
that the mixing of the letters in the checkerboard is fairly good, in normal cases it may be assmned 
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that there will be 1 high-frequency letter, 3 medium-frequency letters, and 1 low-frequency 
letter in each row and in each column of the checkerboard. Suppose the letters in each category 
be as follows: 

High frequency..__ AEINORST 

Medium frequency. BCDFGHLMPUY 

Low frequency.— K Q V W X Z 

Adding the squares of the probabilities for separate occurrence ® of the letters in each category: 

A .0054 B .0001 K .0000 

E .0169 C .0009 Q .0000 

I .0054 D .0018 V .0002 

N .0063 F .0008 W .0002 

0 .0057 G .0003 X .0000 

R .0057 H .0012 Z .0000 

S .0037 L .0013 - 

T .0084 M .0006 Total=.0004 

- P .0007 Average=. 00007 

Total=.0575 U .0007 

Average= . 0072 Y . 0004 

Totals. 0088 
Average=. 0008 

Since each row of figure 90 contains 25 letters, composed of 5 different letters each appearing 5 
times, and it is assumed that each row of the checkerboard contains 2 high-frequency letters, 2 
mediiun-frequency letters, and 1 low-frequency letter, the rows in figure 90 will be composed of 
10 high-frequency letters, 10 medium-frequency letters, and 5 low-frequency letters. Therefore, 
the sum of the squares of the average probabilities of the letters occurring in each row of figure 
90 is as foUows: 

5 X. 0072=.0360 
15 X. 0008=.0120 
5 X. 00007=.0004 

Total=.0484 

This, then, is the constant that should be applied in the x-test for the problem under consider¬ 
ation. Suppose, for convenience, the approximation .05 is used. This is considerably less than 
the normal constant .0667 and means that in the case of this problem two distributions can be 
considered to “match” even if the number of coincidences (value of x) is considerably less than 
what would be expected in the case of the normal type of frequency distribution. However, it 
must be remembered that even if two distributions give an observed value for x that is close to 
or even greater than the expected, one can still not be certain that the two distributions apply to 
identical rows of letters and indicate two letters in the same row in the checkerboard, since it 
may happen that the composition of the checkerboard is such that two rows have letters of about 
the same frequency values, as pointed out above. 

h. With this reservation in mind, let figure 90 be examined. Take rows D and M, which on 
casual examination look a good deal alike, as seen in figure 93. 

* Ab given in the table on p. 114 of Military Cry-ptanalysit, Part 1, Appendix 2, par. 2e (1). 
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Di 

A 


C 

D 

E 

F 

G 

H 

ll 

K 

L 

M^ 

nI 

qI 

p 

Q 

rI 

s 

T 

ul 

V 

w 

1 x' 

Y 

Z 

















'1 









Ml 






_ 1 

_! 

1 





_j 










D 




FlGDBI B3. 


N=23 

N=16 


Applying the x-tcst, the observed value of x=34, the expected value is .05 (23X16)=18. An 
excellent match is obtained, and the hypothesis that D and M are in the same row in the checker¬ 
board seems promising. Can any confirmation be found in the cryptogram itself? 

i. It has already been pointed out that this system reduces to monoalphabetic substitution 
with variants. This being the case it should be possible to find manifestations of equivalency 

between some of the variant forms of ®‘ vertical pairs in the cryptogram. If the student will think 

over the matter he will quickly see that this manifestation of equivalency is but a reflection of 
the principle elucidated in paragraph 46, expressed in a little different way. In other words, 
establishing equivalence between two 0i components means that the two base letters involved 
belong in the same row of the checkerboard; establishing equivalence betweeen two 0j compo¬ 
nents means that the two base letters involved belong in the same colunm of the checkerboard. 
Note the following instances of apparent equivalency between Di and Mi: 



Period 16 

DjBi 

D, B, 

Period 18 

GsQ. 

DiQ, 



20 

Y,Bi 

D, B, 

32_ 

LsQi 

MiQ, 



49 

TsBi 

DiB, 

16 

Ft El 

DiEt 



_2_ 

YsBi 

MiBs 

17 

F,Ei 

Di E, 


'j 

3 

Z*Gi 

DiG, 

59_ 

G,E, 

MiE, 


1 ' 

_56_ 

NsGi 

M, Gi 

12 

Ai B, 

A,Di 

BiD, 


13 

QiLi 

Di L, 

50 

AiB, 

A,Di 

HiD, 


37 

ZaLi 

DiL* 

8 

DiB, 

D,Mi 

RiM, 

1 

58 

NaLi 

DiL, 

19 

DiN, 

D,Di 

UiD, 

I 

66 

Zs Ll 

DiL, 

46 

Dll, 

D,Di 

NiD, 


71 

Z,Li 

DiL, 

44_ 

DiZ, 

D,Mi 

BiM, 

i 

6 

AiLi 

Ml U 

43 

UiA, 

U,Di 

CiD, 


13 

YjLi 

MiLt 

67 

UiE, 

U,Mi 

PiM, 


58 

Is Ll 

MiU 






It may be assumed Di= 

Ml and 1 

the two distributions in figure 93 may be amalgamated. 


Di + Mi A B 

C D E 

F G H I 

KLMNOPQRSTUVWXYZ 



§ 

- -- 

- 1 ^ - 

^ ' 


-- 

1 j 




§ 





1! 


The only other row in figure 90 which gives indications of being similar to this distribution is the 
A row. Applying the x-test individually to the Di and Mi distributions, and then to the combined 
Di+Mi distribution: 

ABCDEFGHIKLMNOPQRSTUVWXYZ 

§ j|=23 


Di 

T 


N = 24 
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Expected for plain text: .05 (23X21)=24 

Expected for random text: .038 (23X21) = 18 
Observed =26 


ABCDEFGHIKLMNOPQRSTUVWXYZ 
Ml ^ ^ 



Expected for plain text: .05 (16X21) = 17 
Expected for random text: .038 (16X21) = 13 
Observed = 14 


ABCDEFGHIKLMNOPQRSTUVWXYZ 

DiMi ^ j 

"T N=21 


Expected for plain text: .05 (39X21)=41 
Expected for random text: .038 (39X21)=31 
Observed =39 


From the foregoing calculations it appears that Ai may be similar to the Di and the Mi distnbu- 
tions, for the observed values, whUe not as great as expected for plain text, are higher than those 
expected for random text. Perhaps more conclusive evidence may be found if a search were 
made through the text to see if any equivalences between Ai, Di, and Mi, appear. 

Note the following cases: 


Period 


8 

Y,B, 

AiB, 

A, Ml 

12 

N,Bi 

Ai B, 

A, Di 

50 

N,Bi 

Ai B, 

A,Di 

16 

D,Bi 

D1B2 

D,Ai 

20 

YaBi 

Di B, 

D,Ai 

49 

T,Bi 

DiB* 

D,Fi 

2 

Y,Bi 

Ml B, 

M,Ri 

21 

C,Gi 

AiG, 

A,Xi 

30 

KtGi 

AiG, 

SiP, 

3 

Z,G, 

DiG, 

Bi K, 

56 

N,Gi 

M1G2 

M2R1 

24 

X,Ki 

A1K2 

R1Z2 

34 

T,Ki 

M1K2 

M2Q1 


Period 33 

L,Pi 

AiP, 

A,Wi 

48 

U,Pi 

MiP, 

OiM, 

15 

G,Qi 

AiQ, 

A,Bi 

18 

GsQi 

DiQ, 

D,N, 

32 

L,Qi 

M1Q3 

M2H1 

14 

N,Xi 

AiX, 

Aa Cl 

61 

F,Xi 

DiX, 

DaHi 

57 

Q,Yi 

Ai Y, 

IiD, 

72 

F2Y1 

AiY* 

A,Di 

63 

U,Yi 

DiY, 

DaAi 


It certainly seems as though Ai=Di=Mi, and that these letters are in the same row in the checker¬ 
board. This tentatively will be assumed to be correct. 


324165—41-12 
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j. Among the most frequent combinations is the pair YgBi, appearing in the following 
sequences; 


Period 2 

YgCi 

YiCg 

YgBi 

MiBg 

MgR, 

8 

LiQg 

Yi Wg 

YgB, 

AiBg 

AgM, 

10 

Bi Ag 

YiOg 

YgBi 

EiBg 

EgRi 

20 

N.Lg 

YiWg 

YgBi 

DiBg 

D,A, 

41 

HiLg 

YiMg 

Y,B, 

SiBg 

SgO, 


Note how Ml, Ai, Ei, Di, and Si all appear to bo interchangeable. Are these the 5 letters which 
belong in the same row? The probable equivalence among Ai, Di, and Mi has been established by- 
noting cases of equivalency in the text. A further search will be made to see if Ei and Si also 
show equivalencies with Ai, Di, and Mi. 

Note the following: 


Period 21 

CgGi 

AiGg 


Period 12 

NgBi 

A.Bg 

AgD, 

30 

KgGi 

AiGg 


10 

YgB, 

El Bg 

EgRi 

3 

69 

56 

ZgGi 
Og Gi 
NgGi 

DiGg 

El Gg 
M, Gg 


30 

33 

LgP. 

LgP, 

EiPg 
A, Pg 

EgRi 

AgWi 

23 

32 

DiXg 

MiQg 

D»Hi 
Mg Hi 

AiHg 

AiHg 

43 

57 

Cg Yi 

Q 2 Y 1 

El Yg 
AiYg 

IiLg 

IiDa 

61 

DiXg 

DgHi 

EiHg 






Here are indications that Ei belongs to the same series, but not enough cases where Si is inter¬ 
changeable with A, D, E, or M can be found to be convincing. But perhaps it is best not to go 
too fast in these early stages. Let it be assumed for the present that A, D, E, and M are in the 
same row of the substitution checkerboard. In period 16 there is the pair of vertical com¬ 
ponents Di Eg. Since Di=Ei this pair may be written EiEg, whereupon the plain-text letter E is 
immediately indicated. All cases of this sort are sought in the text and the plain-text letters 
are inserted in their proper places, there being 7 such instances in all, but these yield the im¬ 
portant letters. A, D, and E. 

k. In a similar manner, by an intensive search for cases in which components appear to be 
equivalent because they occur in repetitions which are identical save for one or two components, 
it is established that C, 0, M, and W are in the same column in the checkerboard. Note the bracket¬ 
ing of these letters occurring as Og components in the 4th column of the first list of sequences 
in subparagraph j. Likewise, B, H, and N are established as being in the same row. Again 
the text is examined for cases in which plain-text letters C, 0, M, W, B, H, and N may be inserted. 
By carrying out this process to the full extent possible, the skeletons of words will soon begin 
to appear. 

l. Enough has been demonstrated to show this line of attack. Of course, if there is a large 
volume of text at hand, the simplest procedure would be to construct frequency distributions 
of the types shown in figures 90 and 91, and use the statistical method to match the individual 
distributions. For this method to be reliable it would be necessary to have several hundred 
letters of text, but this in actual practice would not be too much to expect. 

m. There is, however, another line of attack, based upon the probable-word method. It 
has been pointed out that, in the case of letters in odd positions in the periods, 40 percent of the 
time the plain-text letter involved is indicated by either its 0i or 0g component. This property 
affords a fair basis for assuming a probable word. For example, the cryptogram here studied 
shows the following two periods: 


Period_ 

Plain text. 


35 


175 


36 


Components. 
Cipher text.. 


Vi V, Hi Hg Si Sg Ii 
Ig Xi Xg Si Sg Li Lg 
V H S I X S L 


Li Lg Wi Wg Xi Xg Li 
Lg Xi Xg Ri Rg Si Sg 
L W X L X R S 


Two letters are quite definite, S, and L,. Suppose the possible plain-text letters be indicated. 


Period. 36 

Possible plain-f V . H . S . 
text letters-.-ll_X_ 


Components. 
Cipher text... 


Vi Vg Hi Hg Si Sg 
J, Xi Xg Si Sg Li 
V H S I X S 


I 

Ii 

iLi 

L 


36 

L . W . X . L 
X R S 
Li Lg Wi Wg Xi Xg Li 
Lg Xi Xg Ri Rg Si Sg 
L W X L X R S 


The word HOSTILE is suggested by the letters H . S . I L . . This word will be assumed to be 
correct anH it will be written out with its components under the cipher components. Thus: 


Period- 

35 

36 

Plain text_ 

H 0 S T I 

L E 

Cipher-text components._| 

1V, Vg Hi Hg Si Sg Ii 
ilg XiXgS, SgLiLg 

LiLg 

LgX, 

Plain-text components__* 

Hi 0i Si Ti Ii 

H* Og Si Tg Ig 

LiEi 

LgEg 


This word, if correct, yields the following equivalencies: Hg=Xg=0i;Si=0g; Ti=Sg; Li=Tg; Ig= 
Lg=Ei; Xi=Eg. Again the text is examined for cases in which the plain-text letters may now be 
directly inserted; but only one case is found, in period 44, where Ii Lg=Ii Ig=Ip. This is un¬ 
fortunate, so that additional words will have to be assumed. The 14th period shows a Cp 
and the components after it suggest that the word CROSSROADS may be present. Thus: 


Period... 


Plain text_ 

Components... 
Cipher text_ 


14 

_ C R 0 

Ng Ai Ag Cl Cg 0i 
Xi Xg Cl Cg Ri Rg 

A C 0 X C R 


15 

S S R 0 A D S 
Ri Rg Gi Gg Ai Ag Si 
Sg_W^^_Qi_Qg_B^J^ 
R G A S W Q B 


Take the first letter Rp, represented by Cg Ri. 

Since Rp=Cg Ri, 
Therefore, Ri Rg=Cg Ri 

Hence Ri=Cg and Rg=Ri 
Therefore, Ri=Rg=Cg 


Again, in the case of the first Op, 

0p=0i Rg 

But 0p=0i 0g=0i Rg 
0g=Rg 

Therefore, Ri=Rg=0g=Cg 
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The various equivalencies yielded are as follows: 


Cl—Ri=Oi=Si=Ri=Gi=Wi=Qi Bi=Di 

S,=W,=B,=T, Li=T, 

H,=X*=0i=Gi Li=Ii=E, 

0,=Qi Xi=E, 

Q,=A,=:Di 


71. Let all the equivalencies found thus far from subparagraphs e,f, and h be collected in two 
tables, as shown in %ure 94, one for 0, G, combinations, the otW for 0, 0, combinations. 


A, Bi Cl D, El Fi Gi Hi I, K, L, M, N, 0, P, Q, R, S, T, U, V, W, X, Y, Z, 


D, H, Ai Ai 

O 2 Bi 

Tb Ai Bi 

Hb 

Gi Gi O 2 Sb 

TiE, 

El Ni El Di 

C, Ni 

Di Hi X, 

0, C, C, Wi 

Sb 

Ml D, Ml Ml 

M, D, 

El Db Gb 

Cb Ob Mb Bb 

B, 

I. 1* I» 

W 2 

Ib 


Mb Mb Wb 


L 2 L, Lb 

Ri 

Lb 


Wb Wb Ri 


A, A, A 2 

Rb 

Ab 


Ri Rb Rb 


Q 2 0, 0, 

Si 

Qb 


Rb Si Gi 



Qi 



Si Qi Qi 


A, B, C 2 D, E, 

Fb Gb Hb Ib Kb L, Mb Nb 

Ob Pb 

Qb Rb Sb T, U, 

Vb Wb Xb Y, Z, 

Ai Ti M 2 Bi Xi 

0i Xb Lb 

Ib Cb 

Cb 

Lb Cb Ti Li 

Cb Hb 

Di S 2 O 2 Hi 

H, 0i Ai 

Ai Ob 

Mb 

Ib Mb Wi 

Mb 0i 

El Wi W 2 Ni 

Xb Gb Di 

Di Wb 

Wb 

Ai Ob Bb 

Ob Gb 

Ml Ri 

El 

El Ri 

Si 

Di Wb 

Si 

I* Si 

Ml 

Ml Si 

Ri 

El Si 

Ri 

L, R, 

A, 

Ab Rb 

Rb 

Ml Ri 

Rb 

Qb Gi 

Qb 

Qb Gi 

Gi 

Ab Gi 

Gi 

Qi 


Qi 

Qi 

Qi 

Qi 


Fravu 94 


A study of the equivalencies indicates that— 

(1) A, D, E, H belong in the same row. 

(2) B, H, N belong in the same row. 

(3) G, R, S, Q belong in the same row. 

(4) R, C, 0, M, W belong in the same column. 

(5) I, L, A, Q belong in the same column. 

(6) X, H, G belong in the same column. 

(7) The coordinates of R and A are identical and hence this letter occupies a cell along 

a diagonal sloping from left to right in the matrix. 


0 . Since a row or a column can contain only 5 letters, it is obvious that A, D, E, M; B, H, N; 
and G, R, Q, S, fall in 3 different rows; C, 0, M, W, R and I, L, A, Q fall in different columns. A 
start may be made by an arbitrary placement of R in the position 1-1, and since Ri=0g=Ca= 
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this means that R, 0, C, M, and W form one column in the substitution checkerboard, as 
shown in figure 95-A. The data also indicate that R, G, Q, and S must be in row 1, A, D, and E 

2<i component 

1 2 3 4 5 

GS 


X 

ADE 


H I 
X L 

Fiqube 95-A. 

must be in row 4, H and X must be in column 3. This means that 0, for A, D, and E must be 4, 
and that 0, for H and X must be 3. And since M,=l 2 =La, 0, for I and L must be 4. Substitut¬ 
ing in the text the coordinates for the known values, additional plain-text words soon become 
evident. For example, taking the periods with the word HOSTILE, it becomes possible to insert 

Period__ 35 "^4 36 


Cipher text_ VHSIXSL; LWXLXRS 

the letters Rp and Op as the second and fourth letters after Ep, suggesting that the word after 
HOSTILE is TROOP. This gives W, X 2 =Tp, which permits of placing T in position 5-3. Since T in 
H0STILE=S2 Li, therefore S2=5 and Li=3. Since S is in row 1, and S2=5, S must go in position 
1-5. Since L2=4 and Li=3, L must go in position 3-4. Since Op (the 1st 0 in TR00P)=XiR2 
and it is known that 0p=3-l, therefore X must be in position 3-3. The checkerboard is now as 
shown in figure 95-B. From figme 94, Xi=E 2 . Now Xi=3, and since the E must be in row 4, 

02 0 , 


Plain text_^___H_0_S_T_I i | 

r. * fViVjHiHjSiS, Ii ^ 

Components—I X, S, S, L, L, ' 


L E _ 

Li L, Wi W, Xi X, Li 
L 2 Xi X 2 R, R 2 S. S 2 



1 2 3 4 5 


1 2 3 4 5 



H I 

Fiotok 95-B. 


H I 

Fioob«9&-C. 
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it is evident that E must occupy cell 4-3, as seen in figure 95-C. There are now only 2 possible 
rows for H, either 1 or 2. It is deemed unnecessary to give further details of the process. SuflSce 
it to say tiiat in a few minutes the entire checkerboard is found to be as shown in figure 95-D. 
It will decipher the entire cryptogram as it stands, but speculating upon the presence of W U T V Z 
in the last row, and assuming a key-word mixed sequence has brought this about, a rearrange¬ 
ment of the columns of the checkerboard is made to give T U V W Z, as shown in figure 95-E. 
The arrangement of the rows now becomes quite evident and the original checkerboard is foimd 
to be as shown in figure 95-F. It seems to be based upon the key phrase XYLOPHONIC BEDLAM. 

02 02 0j 


12345 32415 12345 



p. The completely deciphered cryptogram is as follows: 


12 3 4 


s 

4 

I 

3 

T 

6 

U 

5 

A 

3 

T 

6 

1 

2 

0 

N 

2 

0 

1 

N 

2 

F 

3 

R 

0 

1 

N 

2 

T 

5 

0 

F 

3 

T 

5 

w 

5 

E 

3 

N 

2 

T 

5 

Y 

F 

3 

0 

U 

5 

R 

5 

K 

3 

z 

F 

2 

B 

E 

I 

L 

Y 

Y M 

2 

0 

c 

B 

R 

2 

B 

L 

Z 

5 

D 

0 

T 

1 

G 

2 

B 

L 

3 

P 

5 

K 

y 

2 

w 

C 














14 







21 







38 




5 







6 







7 







8 




T 

5 

H 

2 

B 

2 

R 

1 

2 

G 

A 

3 

D 

E 

3 

A 

S 

F 

0 

L 

L 

0 

W 

S 

c 

2 

0 

L 

0 

N 

2 

F 

3 

I 

3 

R 

s 

T 

5 

u 

C 

5 

c 

4 

E 

3 

P 

1 3 

Q L 

A 

M 

E 

Y 

L 

4 3 

z Q 

X 

W 

H 

5 

L 

R 

4 3 

W Q 

Y 

3 

D 

5 

R 

3 

V 

B 

5 

M 

1 

T 







35 







42 







49 







56 




9 







10 







11 







12 




B 

3 

A 

3 

T 

8 

T 

5 

A 

3 

L 

1 

2 

0 

N 

F 

3 

0 

R 

4 

T 

Y 

s 

E 

V 

5 

E 

3 

N 

T 

H 

1 

2 

N 

3 

F 

3 

A 

3 

N 

3 

T 

5 

R 

I 

z 

E 

B 

3 

E 

3 

L 

3 

A 

4 

Y 

2 

E 

5 

s 

0 

B 

R 

2 

y 

5 1 3 

Q V B 

B 

3 

L 

Y 

X 

3 2 

N A 

5 3 2 

B Q B 

D 

4 

0 







83 







70 







77 







84 




13 







14 







15 







16 




y 

1 

H 

2 

A 

3 

S 

R 

E 

3 

A 

3 

C 

3 

H 

3 

E 

D 

3 

C 

3 

R 

0 

S 

S 

R 

0 

A 

D 

3 

S 

E 

3 

V 

5 

E 

3 

N 

2 

F 

3 

1 

2 

V 

5 

3 1 3 

Y M Q 

D 

4 

L 

w 

3 

L 

N 

A 

C 

2 

0 

X 

C 

R 

5 

R 

G 

A 

S 

3 

w 

2 0 

Q B 

F 

3 

D 

D 

2 

T 

E 

3 

B 

3 

A 


91 98 105 


179 


17 18 19 20 


E 

S 

E 

V 

E 

N 

D 

3 

D 

3 

A 

3 

s 

H 

2 

R 

0 

1 

A 

3 

D 

3 

J 

2 

u 

5 

N 

2 

c 

2 

T 

5 

1 

2 

0 

N 

2 

F 

3 

1 

2 

V 

E 

3 

T 

5 

M 

F 

D 

3 

E 

T 

E 

2 

N 

2 

A 

K 

5 

G 

D 

F 

0 

3 

Q 

2 

D 

3 

U 

2 

B 

N 

D 

c 

3 

L 

4 

y 

2 

D 

5 

V 

W 

3 

B 

A 

X 







119 







126 







133 







140 




21 







22 







23 







24 




H 

R 

E 

E 

T 

H 

R 

E 

3 

E 

G 

4 

S 

T 

5 

0 

1 

P 

E 

N 

2 

E 

M 

3 

y 

H 

2 

0 

L 

D 

3 

s 

W 

0 

0 

D 

3 

C 

4 

A 

U 

G 

G 

X 

4 

0 

A 

R 

T 

5 

X 

1 

X 

T 

5 

s 

D 

2 

A 

Y 

X 

H 

K 

0 

L 

2 

s 

5 

X 

4 

A 

4 

B 

R 

2 

K 







147 







154 







161 







168 




25 







26 







27 







28 




S 

S 

0 

U 

5 

T 

H 

W 

E 

3 

S 

T 

5 

0 

F 

C 

2 

H 

A 

R 

4 

L 

E 

3 

s 

T 

5 

0 

w 

5 

N 

2 

1 

2 

N 

2 

C 

2 

0 

N 

2 

5 

R 

6 

P 

4 

u 

2 

Z 

W 

H 

4 

0 

1 

M 

5 

T 

D 

H 

T 

s 

G 

3 

M 

L 

3 

s 

1 

L 

6 

Q 

1 

P 

0 

4 

u 

2 

N 

H 

c 

I 

C 

K 







175 







182 







189 







196 



29 







30 







31 







32 




S 

I 

D 

E 

R 

4 

A 

3 

B 

L 

E 

3 

F 

3 

0 

R 

c 

2 

E 

3 

S 

T 

5 

0 

P 

w 

1 

2 

L 

L, 

M 

3 

A 

3 

K 

E 

3 

E 

3 

V 

5 

5 

K 

3 

A 

3 

Q 

B 

4 

D 

3 

0 

F 

3 

L 

E 

5 

K 

A 

P 

4 

R 

G 

6 

s 

X 

u 

5 

P 

0 

3 

w 

A 

3 

L 

M 

3 

A 

V 

Q 

H 

L 







203 







210 







217 







224 




33 







34 







35 







36 




E 

R 

Y 

E 

F 

F 

0 

R 

T 

T 

0 

D 

R 

1 

2 

V 

5 

E 

3 

H 

2 

0 

1 

s 

T 

1 

2 

L 

E 

T 

R 

4 

0 

0 

P 

M 

4 

L 

2 

A 

X 

K 

6 

P 

4 

w 

S 

T 

M 

4 

c 

X 

K 

3 

Q 

3 

V 

H 

S 

I 

5 

X 

S 

3 

L 

3 

L 

W 

X 

L 

X 

R 

6 

s 







231 







238 







245 







252 




37 







38 







39 







40 




S 

0 

U 

5 

T 

A 

3 

N 

D 

3 

0 

C 

2 

C 

U 

P 

Y 

1 

D 

3 

E 

3 

F 

3 

E 

3 

N 

2 

s 

4 

1 

2 

V 

E 

P 

0 

1 

S 

1 

2 

T 

5 

1 

2 

6 

G 

4 

z 

2 

D 

F 

3 

K 

L 

2 

N 

Y 

B 

X 

2 

H 

5 

R 

B 

2 

N 

A 

5 

D 

1 

K 

2 

T 

T 

3 

B 

3 

A 

E 

0 

4 

B 

H 

3 

w 

V 

L 







259 







266 







273 







280 




41 







42 







43 







44 




0 

N 

S 

T 

0 

P 

M 

Y 

1 

T 

5 

R 

4 

0 

0 

P 

s 

H 

2 

A 

3 

V 

5 

I 

N 

2 

G 

4 

D 

3 

1 

2 

F 

3 

F 

3 

1 

2 

c 

2 

u 

5 

L 

Y 

2 

S 

X 

M 

B 

0 

W 

2 

P 

1 

G 

4 

X 

K 

0 

5 

R 

5 

z 

1 

I 

u 

3 

C 

3 

E 

2 

A 

D 

2 

Y 

3 

I 

5 

D 

5 

B 

3 

L 

z 

M 

I 







287 







294 







301 







308 




45 






46 







47 







48 




T 

y 

M 

A 

I 

N 

2 

T 

2 

A 

3 

1 

2 

N 

I 

N 

2 

G 

C 

2 

0 

N 

2 

N 

E 

3 

C 

2 

T 

5 

1 

2 

0 

N 

2 

W 

5 

I 

T 

5 

H 

2 

F 

3 

T 

2 

A 

N 

i 

H 

3 

c 

2 

A 

3 

I 

3 

D 

3 

N 

2 

C 

I 

2 

D 

D 

0 

4 

Y 

2 

I 

2 

B 

1 

c 

4 

N 

1 

0 

L 

Y 

U 

U 

M 

c 

E 

P 


315 322 829 







49 

50 



61 






52 



0 

R T Y F I F 

4 1 2 S 3 1 

T H IN F A N 

3 3 3 3 3 3 3 

T 

3 

R 

Y 0 

N 

N 

2 

0 

R 

T 

H S 

2 4 

T 

0 

P 

d 

T D M G B F 

1 1 3 3 3 3 2 

U N A H L B D 

w 

4 

X 

N X 

2 

K 

2 

K 

C 

S 

C 

1 3 

T 0 

X 

T 

3 

S 


343 

350 






357 






364 


63 

64 



55 






56 




E 

N E M Y N 0 

3 3 3 1 2 1 

N C 0 M M I S 

2 2 1 3 3 2 4 

s 

1 

2 

0 N 

1 2 

E 

D 

3 

0 

1 

F 

3 

F 

I C 

E R 

c 

D 

A Y X H K C 

2 4 4 4 4 3 3 

N L D K R R F 

3 

K 

3 

Y 

4 2 

A P 

M 

2 

H 

c 

3 

A 

3 3 4 

N M B 

V 

G 

R 


a?i 

378 






383 






392 


57 

58 



69 






60 




A 

3 

P T U R E D 

N E A R C H A 

2 3 3 4 2 3 3 

R 

L 

E S 

3 4 

T 

0 

1 

w 

3 

N 

2 

S 

T A 

3 3 

T 

E 

s 

E 

3 12 4 13 

Z Q A T C Y 

2 1 3 4 4 1 3 

I M N D L R L 

4 3 

G M 

1 3 

T W 

E 

T 

R 

2 

c 

3 

V 

1 3 

V K 

T 

E 

3 

P 


399 

406 






413 






420 


61 

62 



63 






64 




T 

5 

H A T E N E 

M Y S E V E N 

3 1 4 3 3 3 2 

T 

3 

H 

2 

D I 

3 2 

V 

5 

1 

2 

S 

4 

1 

2 

0 

N I 

S 

M 

0 

u 

13 112 1 

F D E L X H 

4 2 3 1 3 1 2 

E Q V C B L Y 

u 

D 

2 3 

U G 

3 

Y 

3 

A 

3 

F 

3 

H 

N 

2 3 

Q L 

5 

K 

4 

F 

R 


427 

434 






441 





448 


65 

66 



67 






68 




V 

5 

I N G I N T 

0 A T T A C K 

1 3 3 3 3 2 4 

p 

1 

0 

S I 

4 2 

T 

3 

I 

0 

N 

2 

S 

T 0 

N 

I 

G 

u 

3 2 1 3 2 1 

C N V D L H 

4 3 1 1 3 4 2 

L Z D R E L K 

X K 

3 3 

U P 

1 3 4 

S E M 

2 

c 

3 1 4 

T N K 

2 

T 

3 

K 

1 

E 


433 

462 






469 





476 


69 

70 



71 






72 




H 

T P R E P A 

3 14 3 13 

R A T 0 R Y T 

4 1 1 4 4 2 1 

0 

A 

3 

T T 

A 

3 

C 

2 

K 

4 

A 

3 

T 

D A 

S 8 

Y 

L 

I 

B 

0 E E P G V 

Q T G W E R H 

L 

3 

z 

D R 

3 

E 

L 

2 

K 

3 

F 

A 

2 3 

X I 

2 

Y 

3 3 

D A 


483 

490 






(97 





304 


73 

74 



75 










G 

H T T 0 M 0 

2 3 3 1 3 1 

R R 0 W M 0 R 

N 

2 

I 

N G 










K 

1114 4 4 

Z L X X 0 R 

R P E R R R R 

2 

N 

c 

3 1 

I E 
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2 . The steps taken in recovering the original substitution checkerboard demonstrate that 
cyclic permutations of a correct checkerboard will serve to decipher such a cryptogram just as 
well as the original checkerboard. In other words, a ciyptogram prepared according to this 
method is decipherable by factorial 5 (6X4X3X2X1 = 120) checkerboards, all of which are 
cyclically equivalent. Even though the identities of the components will be different if the 
same message is enciphered by two different cyclically-equivalent checkerboards, when these 
components are recombined, they will yield identical cipher texts, and therefore so far as external 
appearances are concerned different checkerboards yield identical cryptograms. The reason 
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that there are only factorial 5 cyclically-equivalent checkerboards and not factorial 10, is that 
whatever permutation is applied to the row coordinates must be the same as that applied to the 
column coordinates in order that the aforesaid relationship hold true. If two checkerboards 
have identical row coordinates but different colunm coordinates certain portions of the crypto¬ 
graphic text will decipher correctly, others incorrectly. For this reason, in working with cryp¬ 
tograms of this type the cryptanalyst may successfully use a checkerboard which is incorrect in 
part and correct it as he progresses with the solution. It may also be added that the actual 
permutation of digits applied to the side and top of the checkerboard is of no consequence, so 
long as the permutations are identical. In other words, the permutation 5-2-1-3-4 will work 
just as well as 3-2-4-1-5, or 1-2-3-4-5, etc., so long as the same permutation is used for both 
row and column coordinates. It is the order of the rows and colunms in the checkerboard 
which is the determining element in this system. Any arrangement (of the letters within the 
checkerboard) which retains the original order as regards the letters within rows and columns 
will work just as well as the original checkerboard. 

r. A final remark may be worth adding. After all, the security of cryptograms enciphered 
by the bifid fractionating method rests upon the secrecy inherent in a 25-ceU matrix containing 
a single mixed alphabet. In ordinary substitution, a single mixed alphabet hardly provides any 
seemity at all. Why does the bifid system, which also uses only a single mixed alphabet, yield 
so much higher a degree of security? Is it because of the transpositional features involved? 
Thinking about tliis point gives a negative answer, for after all, finding the length of the periods 
and replacing the cryptographic text by components based upon the cipher letters is a relatively 
easy matter. The transpositional features are really insignificant. No, the answer to the 
question lies in a different direction and may be summed up about as follows. In solving a 
simple mixed-alphabet substitution cipher one can attack a few cipher letters (the ones of greatest 
frequency) and find their equivalents, yielding fragments of good plain text here and there in 
the cipher text. Once a few values have been established in this manner, say 6 values, the 
remaining 20 values can be found almost from the context alone. And in establishing these 6 
values, the letters involved are not so interrelated that all 6 have to be ascertained simultane¬ 
ously. The cryptanalyst may establish the values one at a time. But in the case of the bifid system 
the equivalents of the plain-text letters are so interrelated that the cryptanalyst is forced to 
assume or establish the positions of several letters in the checkerboard simultaneously, not one 
by one. In other words, to use an analogy which may be only partially justified, the solution 
of a simple monoalphabetic substitution cipher is somewhat like forcing one’s way into an inner 
chamber which has a number of doors each having a single lock; the solution of a bifid fraction¬ 
ated cipher is somewhat like getting into a vault—there is only one door which is provided with 
a complex 5-combination lock and all the tumblers of the lock must be positioned correctly 
simultaneously before the releasing lever can drop into the slot and the door opened. Funda¬ 
mentally, this principle is responsible for the very much greater seciirity of the bifid system as 
compared with that afforded by the simple monoalphabetic system. It is a principle well worth 
remembering and speculating upon. 

53. Special solutions for bifid systems.— a. The security of the bifid system is very con¬ 
siderably reduced if the situation in which it is employed happens to be such that two or more 
messages with identical beginnings, endings, or internal portions can often be expected to occur. 
For in this case it is possible to establish equivalencies between components and quickly recon¬ 
struct the substitution checkerboard. An example will be given to illustrate the steps in a 
specific case. 

5. Here are two cryptograms transmitted by two coordinate units to a superior head¬ 
quarters at about the same time. They show certain identities, which have been underlined. 
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No. 1. QJ^BBL HNM QBDO Y HON DW VU YTE JfflaZD_QTLKE EWAPK flSLIP QDWC 

No. 2. VBN HY X DABG BDO I H O BNWV LYTFW HfiXDfi VLKEW WAX DQ SA BCA NXGX 

c. Apparently these two cryptograms contain almost identical texts. In order to bring the 
identities into the form of superimposed components, it is necessary to transcribe the texts into 
periods of 7 and to superimpose the two messages as shown in figure 96. 

d. The shifting of the second cryptogram 2 intervals to the right brings about the superim¬ 
position of the majority of Sj and 02 components and it may be assumed that for the most part 
the texts are identical. Allowing for slight differences at the beginnings and ends of the two 
messages, suppose a table of equivalencies is drawn up, beginning with the eighth superimposed 

pairs. Thus, hence Ni=N 2 and (^=Di. hence N 2 =H, and Bi=D 3 . Going through 

the text in this manner and terminating with the 42d superimposed pairs, the results are tabulated 
as shown in figure 97. 

e. From these equivalencies it is possible to reconstruct, if not the complete substitution 
matrix, then at least a portion of the matrix. For example, the data show that N, H, B, and I 
belong in the same row; E and F belong in the same row; N, D, U, Y, and K belong in the same 
column, and so on. Experimentation to make all the data fit one checkerboard would sooner or 
later result in reconstructing the checkerboard shown in figure 95-F, and the two messages read 
as follows: 


1. SEVENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN FOUR. 

2. TENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN THREEX. 

j. The foregoing gives a clue to what would happen in the case of an extensive traffic in 
which long phrases or entire sentences may he expected to occur repeatedly. By a proper 
indexing of all the material, identical sequences would be uncovered and these, attacked along 
the lines indicated, would soon result in reconstructing the checkerboard, whereupon all the 
messages may be read with ease. 

64. Solution of trifld systems.— a. In the trifid fractionating system the cipher alphabet is 
tripartite in nature, that is, the plain-text letters are represented by permutations of 3 com¬ 
ponents taken in groups of 3’s, thus forming a set of 27 equivalents, such as that shown below: 


A=lll 

J=211 

S=311 

B=112 

K=212 

T=312 

C=113 

L=213 

U=313 

D=121 

M=221 

V=321 

E=122 

N=222 

W=322 

F=123 

0=223 

X^323 

G=131 

P=231 

Y=331 

H=132 

Q=232 

Z=332 

1=133 

R=233 

?=333 


h. The equivalents may, of course, be arranged in a mixed order, and it is possible to use one 
tripartite alphabet for decomposition and a wholly different one for recomposition. One dis¬ 
advantage of such an alphabet is that it is a 27-element alphabet and therefore some subterfuge 
must be adopted as regards the 27th element, such as that illustrated in the footnote to paragraph 
57 of Special Text No. 166, Advanced Military Cryptography, wherein ZA stands for Z and ZB 
for the 27th character. 






1 2 3 4 .■> 7 

8 9 10 11 12 1.9 14 

Ifi 1(1 17 18 10 20 21 

22 2:* 24 25 26 27 28 

29 311 31 32 3:4 34 M 

;i6 37 38 39 40 41 42 

No. 1-. 

Qi 02 Vi Vi Bi Bi Bi 

Bi Li Li Yi Yi Xi Xi 

...Q y_B B L Y X 

Ni Ni A, Ai Bi Bi Q, 

Qi Bi Bi D, Di 0, Oi 

N O 0 B D 0 

Yi Yi Hi Hi Oi Oi Ni 

N, D, Di Wi Wi Vi Vi 

Y H 0 N D W V 

Ui Ui Y, Yi T, Ti E, 

Ei Mi Mi Hi Hi Qi Qi 

U Y_T E M H_Q 

Z, Zi D, Di Qi Qi Ti 

Ti L, Li Ki Ki E, Ei 

2 0 T L K E 

E, Ei Wi Wi Ai Ai P, 

Pi K, Ki Qi Qi S, S 

E W A P K Q S 

No. 2-_. 

Vi Vi Bi Bi N, Ni Hi 
Hi Yi Yi X, Xi D, Di 
_V B N H Y X D 

1 A, Ai B, Bi G, Gi B, 

Bi Di Di 0, Oi Ii li 

1 A B G B D 0 I 

1 Hi Hi Oi Oi Bi Bi Ni 

Ni Wi Wi Vi Vi L, Li 
1 H 0 B N W V L 

1 Y, Yi T, Ti F, Fi W, 
Wi Hi Hi Q, Qi Xi Xi 
1 Y_T F W FLS X 

1 D, Di Q, Qi V, Vi L, 
Li K, Ki E, Ei W, Wi 
1 dIq V L K E W 

1 W, Wi A, A, Xi Xi Di 
Di Q, Qi S, Si Ai Ai 

1 W A X D Q_S A 


FinuRE 90. 


01 ©, . . . Ai B, Cl Di E, Fi Gi Hi Ii K, Li M, N, 0, P, Q, R, S, T, Ui V. W, X. Yi Z, 


Ai Di 

Qi Fi El Qi 

Ni Ni Wi Ei Li Ni Xi Gi 

V, Bi T, Zi Ti Gi Fi 

Qi Yi 

Ii Vi Vi 

Di Di M, Xi Qi B, Ti 

Pi Pi 

Di N, 

A, 

Yi Yi 

D, Ui 


Li Ni 

Li 

Ni Ni 

A. Di 


liHi 

Ai 

Bi B, 

Ai Yi 


Ml Ki 

Ml 

Ki Ki 

Ii Ki 


Ii 


Ii Hi 

Ii 


Ui 


Ui Ui 

H, 



02 01 . . . Ai Bj C, D, E, Fi Ga Hi la K; L, Mj O2 P2 Q9 R2 Sz T, U; V2 W2 X; Z; 


Ai Ui 

Bi L, Zi Y, 

D. Da Ml Wi N, 

W, D, 

Xi N, E, Mi L, Bi Wi 

Qi 

N, Xi 

Qi B, Qi K, H, 

Zi Ii 

P, Ni F, Ki Ei Di Pi 

Di 

Yi 

A, Yi Di 

I, 

Ai 

Bi Ni 

Li 

Ni 

Li Ni Ai 

Bi 

Li 

Di 

Ni 

Ii 

H, 

Ai Ni Ai 

Ui 

Ai 

Hi 

Ui 

M, 

Ki 

Ml H, Ii 

Di 

Ml 

Ki 

H, 


I, 

Ii 

Ki 


I, 

Ki 


Ui 

Ui 

Yi 


Yi 

I, 


4» 44 4.'> 46 47 4S 49 


Li Li I, li Pi Pi Q. 

Qi Di Di ffi Wi Cl Ci 
L I P Q D ff C 
I Bi Bi Cl Ci Ai Ai N, 
Ni X, Xi G, Gi X, Xi 
I B C A N X G X 


FKiL-RK 97. 


3241M-41 (face p. 182) 





183 


c. The various types of fractionation possible in bifid systems are also adaptable in trifid 
systems. For example, using the alphabet shown above for recomposition as well as decom¬ 
position the encipherment of a message in periods of 7 is as follows: 


Piatotait. _R ELIEFO FYOURRE GIMENTT OMORROW 

(212. 111. 2 13 2. 322.1 liai2 3. 3 222.222.3 

Components.. . \ 32.18 2. 32 28.213.82 83.222.11 32.333.22 

I 3. 2 3 3. 2 3 8 3. 1 3 3. 3 3 2 1. 3 1 2. 2 2 2 3. 1 3 8. 8 3 2 

Ciphertext. _K AQHORR HWFLXIZ BF?NATN NNWROIZ 


Cbyptogeam 

KAQHO RRHWF LXIZA BFZBN ATNNN WROIZ 

d. The solution of a single cryptogram of this nature would be a quite difficult matter, espe¬ 
cially if there were nothing upon which to make assumptions for probable words. But a whole 
series of cryptograms could be solved, following in general the procedure outlined in the case of 
the bifid system, although the solution is, admittedly, much more complicated. The first step 
is to ascertain the length of the period, and when this has been done, transcribe the cipher text 
into components, which in their vertical combinations then represent monoalphabetic equiva¬ 
lents, with, of course, many variants for each letter of the plain text. Then a study is made to 
establish component equivalents, just as in the bifid system. If the text is replete with repeti¬ 
tions, or if a long word or a short phrase may be assumed to be present, a start may be made and 
once this sort of entering wedge has been forced into the structure, its further disintegration and 
ultimate complete demolition is only a matter of time and patience. 

55. Concluding remarks on fractionating systems.— a. It goes without saying that the 
basic principles of fractionation in the bifid and trifid systems are susceptible to a great deal of 
variation and complication. For example, instead of having periods of fixed length through the 
message it is possible to vary the length of the periods according to some simple or complex key 
suitable for this purpose. Or the bifid and trifid systems may be combined into a single scheme, 
enciphering a text by the bifid method and then reenciphering the cipher text by the trifid 
method and so on. Systems of this sort may become so complex as to defy analysis, especially 
if the keys are constantly and frequently varied so that no great amount of traffic accumulates 
in any single key. Fortunately for the cryptanalyst, however, such complex systems as these, if 
introduced into actual usage, are attended by so many difficulties in practice that the enemy 
cryptographic service woidd certainly break down and it would not be long before requests for 
repetition, the transmission of the same cryptogram in different keys, and so on, would afford 
clues to solution. Could such systems be employed successfully in field service there is no doubt 
that from the standpoint of security, the cryptograms would be theoretically secure. But the 
danger of error and the slowness with which they could be operated by the usual cryptographic 
clerks are such that systems of this complexity can hardly be employed in the field, and therefore 
the cryptanalyst may not expect to encounter them. 

b. However, the simple bifid system, the ADFGVX system, and the like, are indeed practicable 
for field use, have been used with success in the past, and may be expected to be in use in the 
future. It is therefore advisable that the student become thoroughly familiar with the basic 
principles of their solution and practice the application of these principles as frequently as pos¬ 
sible. In this connection, the attention of the student is directed to the fact that there is theo¬ 
retically no reason why the bipartite components of the ADFGVX system cannot be recombined 
by means of the same or a different checkerboard, thus reducing the cryptographic text to a form 
wherein it consists of 25 different letters, and at the same time cutting the length of the messages 
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in half. The matter is purely one of practicability: it adds one more step to the process. But it 
must not be overlooked that this additional step would add a good deal of strength to the system, 
for it would shorten, mask, distort, or entirely eliminate similar beginnings and similar endings— 
the two most fruitful sources of attack on this system. 

56. Concluding remarks on transposition systems.— a. Simple transposition systems hardly 
afford any security at all; complex ones may in the case of individual or single messages afford a 
higVi degree of security. But just as soon as many cryptograms in the same key are transmitted 
the chances of finding two or more cr 3 rptograms of identical length become quite good and the 
general solution may be applied. 

b. Contrary to the situation in the case of substitution, in that of transposition wherein the 
letters of the plain-text itself are transposed (not code) the shorter the cryptogram the greater the 
possibility of solution. For, in the case of a message of say only 25 or 30 letters, one might shift 
the letters about and actually reconstruct the plain text as one does in the case of the game called 
“anagrams.” Of course, several different “solutions” may thus be obtained, but having such 
“solutions” it may be possible to reconstruct the system upon which the transposition was based 
and thus “prove” one of the solutions. 

c. The text has confined itself almost entirely to cases of imiliteral transposition, in order to 
demonstrate basic principles. But there is inherently no reason why transposition may not be 
applied to digraphs, trigraphs, or tetragraphs. If longer sequences are used as the imits of 
transposition the security decreases very sharply, as in the case of the ordinary route ciphers of 
the Civil War period. 

d. Transposition designs, diagi-ams, or patterns are susceptible of yielding cryptograms of 
good security, if they are at all irregular or provide for nulls and blank spaces. Such devices are 
particularly difficult to solve if frequently changed. 

c. Transpositions effected upon fixed-length sequences of plain text yield a low degree of 
seemity but when a transposition is appUed to the cipher text resulting from a good substitution 
system or to the code text of cryptograms first encoded by means of an extensive code book the 
increase in the cryptographic security of such cryptograms is quite notable. In fact, transposi¬ 
tion methods and designs are frequently used to “superencipher” substitution text or code and 
play a very important role in this field. Their great disadvantage is that inherent in all trans¬ 
position methods: The addition or deletion of a single letter or two often makes the entire 
cryptogram unreadable even with the correct key. 

jf. The clues afforded by messages with similar beginnings, endings, or internal portions, 
and by repetitions of incorrectly enciphered messages without paraphrasing the original text 
are often sufficient to make a solution possible or to facilitate a solution. For this reason the 
cryptanalyst should note aU cases wherein clues of this sort may be applicable and be prepared 
to take full advantage of them. 


Section XI 
ANALYTICAL KEY 

Paragraph 

Analytical key.. 57 

67. Analytical key.—Continuing the scheme initiated in the first text of this series, the 
analytical key applicable to the subject matter and systems embraced in this text is given 
below. 
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